autoremediator 0.21.2 → 0.22.0

package/dist/api/diet/types.d.ts

@@ -0,0 +1,205 @@
+import type { PackageManager, RemediationConstraints } from "../../platform/types.js";
+import type { VerificationResult } from "../../remediation/verify/types.js";
+/** How sure the analysis is that a declared dependency can be deleted. */
+export type UnusedClassification = "certainly-unused" | "probably-unused" | "used-indirectly";
+export type DependencySection = "dependencies" | "devDependencies" | "optionalDependencies";
+export interface UnusedDependency {
+    name: string;
+    section: DependencySection;
+    /** The range as declared in package.json. */
+    range: string;
+    classification: UnusedClassification;
+    /** Why it is classified this way, in a sentence a reviewer can check. */
+    reason: string;
+    /** Where the evidence was found (files, scripts), when there is some. */
+    evidence?: string[];
+}
+export type ReplaceableStatus = 
+/** The project's whole declared Node range has the replacement. */
+"replaceable"
+/** Some Node version the project declares lacks it: do not migrate until the floor is raised. */
+ | "blocked-by-node"
+/** The project declares no Node floor (`engines.node`, `.nvmrc`), so nothing can be claimed. */
+ | "unknown-node"
+/** The replacement only covers part of the package and the project uses more of it. */
+ | "not-covered";
+export interface ReplaceableDependency {
+    name: string;
+    section: DependencySection;
+    range: string;
+    status: ReplaceableStatus;
+    /** The Node built-in or platform API that replaces the package. */
+    replacement: string;
+    /** Node versions that have the replacement, as a semver range. */
+    nodeRange: string;
+    migration: string;
+    /** `drop-in` behaves the same for the common call; `check-usage` has differences to read first. */
+    fit: "drop-in" | "check-usage";
+    caveat?: string;
+    /** Why the status is what it is (the project's Node range against `nodeRange`, or symbols used). */
+    reason: string;
+    source: string;
+}
+export interface NodeRequirement {
+    /** The project's declared Node range (an `.nvmrc` pin is read as `>=` that version). */
+    range: string;
+    source: "engines.node" | ".nvmrc" | ".node-version";
+    /** Where it was read from, relative to the analysed root. */
+    file: string;
+}
+export interface DietPackageReport {
+    name: string;
+    /** Directory relative to the analysed root; `.` for the root package. */
+    dir: string;
+    manifestPath: string;
+    node?: NodeRequirement;
+    counts: {
+        declared: number;
+        used: number;
+        certainlyUnused: number;
+        probablyUnused: number;
+        usedIndirectly: number;
+        replaceable: number;
+    };
+    /** Declared dependencies with no direct import: the three classifications. */
+    unused: UnusedDependency[];
+    replaceable: ReplaceableDependency[];
+    /** What the scan covered, so a reader can judge how much to trust a `certainly-unused`. */
+    scan: {
+        sourceFiles: number;
+        configFiles: number;
+        dynamicLoadFiles: string[];
+        unparsedFiles: string[];
+        dependenciesInstalled: boolean;
+    };
+}
+export interface DuplicateParent {
+    /** Package that asks for this version; `(project)` or a workspace package name for direct ones. */
+    name: string;
+    version?: string;
+    /** The range the parent declares. Unknown when only resolved versions are on record (pnpm, not installed). */
+    range?: string;
+    direct: boolean;
+}
+export interface DuplicateVersion {
+    version: string;
+    parents: DuplicateParent[];
+    /**
+     * The highest newer installed version that every parent of this one accepts, so a dedupe could
+     * move it there without leaving any parent's range. Absent when none, or when ranges are unknown.
+     */
+    movableTo?: string;
+}
+export type DuplicateVerdict = 
+/** One installed version satisfies every parent's range: `dedupe` or an override to it is safe by semver. */
+"dedupe-within-range"
+/** Some copies can be collapsed within range, others are held by a parent that excludes the rest. */
+ | "partly-dedupable"
+/** Every copy is held by a parent whose range excludes the others: an override or a parent upgrade is needed. */
+ | "needs-override-or-upgrade"
+/** The parents' ranges are not on record, so nothing can be said about range. */
+ | "unknown-ranges";
+export interface DuplicatePackage {
+    name: string;
+    versions: DuplicateVersion[];
+    verdict: DuplicateVerdict;
+    /** The single version a dedupe would converge on, when `verdict` is `dedupe-within-range`. */
+    unifiedVersion?: string;
+    /** One line a reviewer can act on. */
+    summary: string;
+}
+export interface DuplicatesReport {
+    /** False when the lockfile format is not read (the reason is in `note`). */
+    supported: boolean;
+    note?: string;
+    packages: DuplicatePackage[];
+    /** Copies beyond the first, summed over duplicated packages. */
+    extraCopies: number;
+}
+export interface SurfaceComponent {
+    id: "size" | "depth" | "install-scripts" | "deprecated" | "waste" | "duplicates";
+    label: string;
+    /** The measured quantity (a count, or a depth). */
+    value: number;
+    points: number;
+    maxPoints: number;
+    /** How `points` follows from `value`, written out. */
+    formula: string;
+}
+export interface AttackSurface {
+    /** 0 (nothing installed) to 100. Higher means more code you did not choose runs in your project. */
+    score: number;
+    formulaVersion: 1;
+    components: SurfaceComponent[];
+    facts: {
+        installedPackages: number;
+        directDependencies: number;
+        maxDepth: number;
+        installScriptPackages: string[];
+        deprecatedPackages: string[];
+        certainlyUnused: number;
+        probablyUnused: number;
+        replaceable: number;
+        extraCopies: number;
+        /** Installed package.json files read, out of installedPackages (install scripts need them). */
+        manifestsRead: number;
+    };
+    /** What the score could not see. */
+    limits: string[];
+}
+export interface DependencyDietReport {
+    schemaVersion: "1";
+    cwd: string;
+    root: string;
+    packageManager: PackageManager;
+    lockfile?: {
+        path: string;
+        format: "npm" | "pnpm" | "unsupported";
+    };
+    generatedAt: string;
+    packages: DietPackageReport[];
+    duplicates: DuplicatesReport;
+    attackSurface: AttackSurface;
+    summary: {
+        packages: number;
+        certainlyUnused: number;
+        probablyUnused: number;
+        usedIndirectly: number;
+        replaceable: number;
+        duplicatedPackages: number;
+        score: number;
+    };
+    notes: string[];
+}
+export interface AnalyzeDependenciesOptions {
+    cwd?: string;
+}
+export interface RemoveUnusedDependenciesOptions extends AnalyzeDependenciesOptions {
+    packageManager?: PackageManager;
+    policy?: string;
+    /** Run the project's tests as part of verification. Default false. */
+    runTests?: boolean;
+    /** Type-check as part of verification. Default true (when a typecheck script or tsconfig exists). */
+    typecheck?: boolean;
+    constraints?: RemediationConstraints;
+}
+export interface RemovedDependency {
+    /** Workspace package the dependency was removed from (`.` for the root). */
+    dir: string;
+    name: string;
+    section: DependencySection;
+    range: string;
+}
+export type DietApplyStatus = "removed" | "rolled-back" | "nothing-to-remove" | "failed";
+export interface DietApplyResult {
+    status: DietApplyStatus;
+    /** What was (or, when rolled back, would have been) removed. */
+    removals: RemovedDependency[];
+    /** The verifier's verdict on the change. Absent when nothing was changed. */
+    verification?: VerificationResult;
+    /** Set when the removal was undone, or could not be completed. */
+    message: string;
+    /** The analysis the removals were chosen from. */
+    report: DependencyDietReport;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/api/diet/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/api/diet/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAE5E,0EAA0E;AAC1E,MAAM,MAAM,oBAAoB,GAAG,kBAAkB,GAAG,iBAAiB,GAAG,iBAAiB,CAAC;AAE9F,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAAG,iBAAiB,GAAG,sBAAsB,CAAC;AAE5F,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;IAC3B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,oBAAoB,CAAC;IACrC,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,iBAAiB;AAC3B,mEAAmE;AACjE,aAAa;AACf,iGAAiG;GAC/F,iBAAiB;AACnB,gGAAgG;GAC9F,cAAc;AAChB,uFAAuF;GACrF,aAAa,CAAC;AAElB,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,iBAAiB,CAAC;IAC1B,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,mGAAmG;IACnG,GAAG,EAAE,SAAS,GAAG,aAAa,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oGAAoG;IACpG,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,wFAAwF;IACxF,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,cAAc,GAAG,QAAQ,GAAG,eAAe,CAAC;IACpD,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,EAAE,MAAM,CAAC;QACxB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,8EAA8E;IAC9E,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACrC,2FAA2F;IAC3F,IAAI,EAAE;QACJ,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,qBAAqB,EAAE,OAAO,CAAC;KAChC,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,mGAAmG;IACnG,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8GAA8G;IAC9G,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,gBAAgB;AAC1B,6GAA6G;AAC3G,qBAAqB;AACvB,qGAAqG;GACnG,kBAAkB;AACpB,iHAAiH;GAC/G,2BAA2B;AAC7B,iFAAiF;GAC/E,gBAAgB,CAAC;AAErB,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,8FAA8F;IAC9F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,iBAAiB,GAAG,YAAY,GAAG,OAAO,GAAG,YAAY,CAAC;IACjF,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,CAAC,CAAC;IAClB,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAC/B,KAAK,EAAE;QACL,iBAAiB,EAAE,MAAM,CAAC;QAC1B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;QACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;QAChC,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAC7B,eAAe,EAAE,MAAM,CAAC;QACxB,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,+FAA+F;QAC/F,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,oCAAoC;IACpC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,GAAG,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,aAAa,CAAA;KAAE,CAAC;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,aAAa,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,+BAAgC,SAAQ,0BAA0B;IACjF,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qGAAqG;IACrG,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,sBAAsB,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,aAAa,GAAG,mBAAmB,GAAG,QAAQ,CAAC;AAEzF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,eAAe,CAAC;IACxB,gEAAgE;IAChE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,6EAA6E;IAC7E,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,MAAM,EAAE,oBAAoB,CAAC;CAC9B"}

package/dist/api/diet/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/api/diet/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/api/diet/types.ts"],"names":[],"mappings":""}

package/dist/api/diet/unused.d.ts

@@ -0,0 +1,73 @@
+import type { PackageUsage } from "./scan.js";
+import type { DependencySection, UnusedDependency } from "./types.js";
+export interface Manifest {
+    name?: string;
+    version?: string;
+    private?: boolean;
+    engines?: unknown;
+    scripts?: Record<string, string>;
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+    peerDependenciesMeta?: Record<string, {
+        optional?: boolean;
+    }>;
+    bin?: string | Record<string, string>;
+    bundledDependencies?: string[];
+    bundleDependencies?: string[];
+    [key: string]: unknown;
+}
+export declare const SECTIONS: readonly DependencySection[];
+/** The manifest fields a tool reads its configuration from (`eslintConfig`, `jest`, `babel`, ...). */
+export declare function manifestConfigText(manifest: Manifest): string;
+/** `Manifest.scripts` as one text per script, labelled for evidence. */
+export declare function scriptTexts(manifest: Manifest): [label: string, text: string][];
+export declare function readManifest(file: string): Manifest | undefined;
+/** `node_modules/<name>/package.json`, looked up the way Node resolves it: here, then each parent. */
+export declare function readInstalledManifest(packageDir: string, name: string, stopAt: string): Manifest | undefined;
+/** Command names a package installs, from its `bin` field. */
+export declare function binNames(manifest: Manifest, packageName: string): string[];
+/**
+ * Names a token in a config file, CI file or script can stand for. ESLint, Babel, Prettier and
+ * Stylelint load `react` as `eslint-plugin-react`, `@babel/env` as `@babel/preset-env`, and so on;
+ * `ts-node/register` is the package `ts-node`; tsconfig `types: ["node"]` is `@types/node`.
+ */
+export declare function candidatePackages(token: string): string[];
+/** A name found in a script or config token, with the file it came from. */
+export interface TokenIndex {
+    /** Package names a token can stand for. */
+    candidates: Map<string, string>;
+    /** Raw tokens, for matching command names. */
+    raw: ReadonlyMap<string, string>;
+}
+export declare function indexTokens(tokens: ReadonlyMap<string, string>): TokenIndex;
+export interface ClassifyContext {
+    packageDir: string;
+    /** Where `node_modules` lookups stop (the workspace root, or the package itself). */
+    stopAt: string;
+    manifest: Manifest;
+    usage: PackageUsage;
+    index: TokenIndex;
+    /** Usage found in other workspace packages, for a root package whose dependencies they use. */
+    elsewhere?: {
+        usage: PackageUsage;
+        index: TokenIndex;
+        packageName: string;
+    }[];
+    hasTypeScript: boolean;
+    hasTsconfig: boolean;
+}
+export interface Classified {
+    /** Dependencies the source imports directly. */
+    used: string[];
+    unused: UnusedDependency[];
+    dependenciesInstalled: boolean;
+}
+/**
+ * Sort a package's declared dependencies into used (imported), used indirectly (named by a script,
+ * a config, a type package, a peer), and unused: certainly when every way it could be used was
+ * checked and none applies, probably when something the scan cannot see remains possible.
+ */
+export declare function classifyDependencies(context: ClassifyContext): Classified;
+//# sourceMappingURL=unused.d.ts.map

package/dist/api/diet/unused.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unused.d.ts","sourceRoot":"","sources":["../../../src/api/diet/unused.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,WAAW,QAAQ;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,eAAO,MAAM,QAAQ,EAAE,SAAS,iBAAiB,EAIhD,CAAC;AA+BF,sGAAsG;AACtG,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAK7D;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAK/E;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAO/D;AAED,sGAAsG;AACtG,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,QAAQ,GAAG,SAAS,CAWtB;AAED,8DAA8D;AAC9D,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAI1E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAyCzD;AAKD,4EAA4E;AAC5E,MAAM,WAAW,UAAU;IACzB,2CAA2C;IAC3C,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,8CAA8C;IAC9C,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,UAAU,CAO3E;AASD,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,UAAU,CAAC;IAClB,+FAA+F;IAC/F,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,YAAY,CAAC;QAAC,KAAK,EAAE,UAAU,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9E,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAKD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,GAAG,UAAU,CA4PzE"}

package/dist/api/diet/unused.js

@@ -0,0 +1,342 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { toRootPackageName } from "../../remediation/tools/check-reachability.js";
+export const SECTIONS = [
+    "dependencies",
+    "devDependencies",
+    "optionalDependencies",
+];
+/** Manifest fields that describe the package rather than configure a tool. */
+const STRUCTURAL_FIELDS = new Set([
+    "name",
+    "version",
+    "description",
+    "keywords",
+    "homepage",
+    "bugs",
+    "license",
+    "author",
+    "contributors",
+    "funding",
+    "repository",
+    "dependencies",
+    "devDependencies",
+    "optionalDependencies",
+    "peerDependencies",
+    "peerDependenciesMeta",
+    "bundledDependencies",
+    "bundleDependencies",
+    "dependenciesMeta",
+    "overrides",
+    "resolutions",
+    "pnpm",
+    "scripts",
+    "files",
+    "publishConfig",
+]);
+/** The manifest fields a tool reads its configuration from (`eslintConfig`, `jest`, `babel`, ...). */
+export function manifestConfigText(manifest) {
+    const config = {};
+    for (const [key, value] of Object.entries(manifest))
+        if (!STRUCTURAL_FIELDS.has(key))
+            config[key] = value;
+    return JSON.stringify(config);
+}
+/** `Manifest.scripts` as one text per script, labelled for evidence. */
+export function scriptTexts(manifest) {
+    return Object.entries(manifest.scripts ?? {}).map(([name, text]) => [
+        `package.json#scripts.${name}`,
+        text,
+    ]);
+}
+export function readManifest(file) {
+    try {
+        const parsed = JSON.parse(readFileSync(file, "utf8"));
+        return typeof parsed === "object" && parsed !== null ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** `node_modules/<name>/package.json`, looked up the way Node resolves it: here, then each parent. */
+export function readInstalledManifest(packageDir, name, stopAt) {
+    let directory = resolve(packageDir);
+    const limit = resolve(stopAt);
+    for (;;) {
+        const file = join(directory, "node_modules", name, "package.json");
+        if (existsSync(file))
+            return readManifest(file);
+        if (directory === limit)
+            return undefined;
+        const parent = dirname(directory);
+        if (parent === directory)
+            return undefined;
+        directory = parent;
+    }
+}
+/** Command names a package installs, from its `bin` field. */
+export function binNames(manifest, packageName) {
+    const bin = manifest.bin;
+    if (typeof bin === "string")
+        return [packageName.split("/").at(-1) ?? packageName];
+    return bin && typeof bin === "object" ? Object.keys(bin) : [];
+}
+/**
+ * Names a token in a config file, CI file or script can stand for. ESLint, Babel, Prettier and
+ * Stylelint load `react` as `eslint-plugin-react`, `@babel/env` as `@babel/preset-env`, and so on;
+ * `ts-node/register` is the package `ts-node`; tsconfig `types: ["node"]` is `@types/node`.
+ */
+export function candidatePackages(token) {
+    const root = toRootPackageName(token);
+    const names = new Set([root]);
+    if (root.startsWith("@")) {
+        const [scope, name] = root.split("/");
+        if (scope && name) {
+            for (const prefix of [
+                "eslint-plugin-",
+                "eslint-config-",
+                "babel-preset-",
+                "babel-plugin-",
+                "preset-",
+                "plugin-",
+                "stylelint-config-",
+            ]) {
+                names.add(`${scope}/${prefix}${name}`);
+            }
+            names.add(`@types/${scope.slice(1)}__${name}`);
+            // `plugin:@scope/recommended` names the scope's plugin, whatever follows the slash.
+            names.add(`${scope}/eslint-plugin`);
+            names.add(`${scope}/eslint-config`);
+        }
+        else if (scope) {
+            for (const suffix of ["eslint-plugin", "eslint-config", "babel-preset", "prettier-config"])
+                names.add(`${scope}/${suffix}`);
+        }
+    }
+    else {
+        for (const prefix of [
+            "eslint-plugin-",
+            "eslint-config-",
+            "babel-preset-",
+            "babel-plugin-",
+            "prettier-plugin-",
+            "stylelint-config-",
+            "stylelint-plugin-",
+        ]) {
+            names.add(`${prefix}${root}`);
+        }
+        names.add(`${root}-loader`);
+        names.add(`@types/${root}`);
+    }
+    return [...names];
+}
+const PLUGIN_STYLE = /(^|\/)(eslint-(plugin|config)-|babel-(plugin|preset)-|prettier-plugin-|stylelint-(config|plugin)-|vite-plugin-|rollup-plugin-|webpack-plugin-|postcss-|remark-|rehype-|unplugin-)|-(loader|plugin|preset|adapter)$|^@[^/]+\/(eslint-(plugin|config)|babel-preset|preset-|plugin-)/;
+export function indexTokens(tokens) {
+    const candidates = new Map();
+    for (const [token, where] of tokens) {
+        for (const name of candidatePackages(token))
+            if (!candidates.has(name))
+                candidates.set(name, where);
+    }
+    return { candidates, raw: tokens };
+}
+/** The package an `@types/*` package describes: `@types/node` is `node`, `@types/s__n` is `@s/n`. */
+function typesNeeded(name) {
+    if (!name.startsWith("@types/"))
+        return undefined;
+    const target = name.slice("@types/".length);
+    return target.includes("__") ? `@${target.replace("__", "/")}` : target;
+}
+const BASE_REASON = "no import, require, string reference, script, config or workflow names it, and it provides no command";
+/**
+ * Sort a package's declared dependencies into used (imported), used indirectly (named by a script,
+ * a config, a type package, a peer), and unused: certainly when every way it could be used was
+ * checked and none applies, probably when something the scan cannot see remains possible.
+ */
+export function classifyDependencies(context) {
+    const { manifest, usage, index } = context;
+    const declared = [];
+    for (const section of SECTIONS) {
+        for (const [name, range] of Object.entries(manifest[section] ?? {})) {
+            if (!declared.some((entry) => entry.name === name))
+                declared.push({ name, section, range });
+        }
+    }
+    const bundled = new Set([
+        ...(manifest.bundledDependencies ?? []),
+        ...(manifest.bundleDependencies ?? []),
+    ]);
+    const installed = new Map(declared.map((entry) => [
+        entry.name,
+        readInstalledManifest(context.packageDir, entry.name, context.stopAt),
+    ]));
+    const dependenciesInstalled = declared.length === 0 || [...installed.values()].some((value) => value !== undefined);
+    // A package that another declared dependency lists as a peer is there for that dependency.
+    const peerOf = new Map();
+    for (const [dependent, installedManifest] of installed) {
+        for (const peer of Object.keys(installedManifest?.peerDependencies ?? {})) {
+            const optional = installedManifest?.peerDependenciesMeta?.[peer]?.optional === true;
+            const known = peerOf.get(peer);
+            if (!known || (known.optional && !optional))
+                peerOf.set(peer, { dependent, optional });
+        }
+    }
+    const used = [];
+    const unused = [];
+    const pending = [];
+    const typeEntries = [];
+    const indirect = (entry, reason, evidence) => ({
+        name: entry.name,
+        section: entry.section,
+        range: entry.range,
+        classification: "used-indirectly",
+        reason,
+        ...(evidence ? { evidence } : {}),
+    });
+    for (const entry of declared) {
+        const { name } = entry;
+        const reference = usage.references.get(name);
+        if (reference) {
+            used.push(name);
+            continue;
+        }
+        // 1. Type declarations: `@types/node` follows TypeScript use; the rest follow their package (below).
+        const typesFor = typesNeeded(name);
+        if (typesFor === "node" && (context.hasTypeScript || context.hasTsconfig)) {
+            unused.push(indirect(entry, "Node's global and built-in types, which any TypeScript source here relies on"));
+            continue;
+        }
+        if (typesFor && typesFor !== "node") {
+            typeEntries.push({ entry, target: typesFor });
+            continue;
+        }
+        // 2. TypeScript with a tsconfig is driven by the compiler, editors and bundlers.
+        if (name === "typescript" && context.hasTsconfig) {
+            unused.push(indirect(entry, "a tsconfig.json is present, and editors and build tools load TypeScript itself"));
+            continue;
+        }
+        // 3. Named by a script, a config file, a CI workflow or a manifest tool section.
+        const configured = index.candidates.get(name);
+        if (configured) {
+            unused.push(indirect(entry, "named by tool configuration or a script", [configured]));
+            continue;
+        }
+        // 4. One of its commands is run.
+        const installedManifest = installed.get(name);
+        const commands = installedManifest ? binNames(installedManifest, name) : [];
+        const usedCommand = commands.find((command) => index.raw.has(command));
+        if (usedCommand) {
+            unused.push(indirect(entry, `its command "${usedCommand}" is run`, [index.raw.get(usedCommand)]));
+            continue;
+        }
+        // 5. Another declared dependency lists it as a peer (an optional peer is loaded when present).
+        const peerFor = peerOf.get(name);
+        if (peerFor) {
+            unused.push(indirect(entry, `a${peerFor.optional ? "n optional" : ""} peer dependency of ${peerFor.dependent}${peerFor.optional ? ", which uses it when installed" : ""}`));
+            continue;
+        }
+        // 6. Declared again as this package's own peer: the development copy.
+        if (manifest.peerDependencies?.[name]) {
+            unused.push(indirect(entry, "also declared as a peer dependency (the development copy used to build and test against)"));
+            continue;
+        }
+        // 7. Named as a string: a mock, a dynamic specifier, a plugin list in a script file.
+        const mention = usage.mentions.get(name);
+        if (mention) {
+            unused.push(indirect(entry, "named in a string rather than imported (a mock path, plugin list or dynamic specifier)", mention));
+            continue;
+        }
+        // 8. Used by another package of the workspace, for dependencies declared at the root.
+        const consumer = context.elsewhere?.find((other) => other.usage.references.has(name) ||
+            other.usage.mentions.has(name) ||
+            other.index.candidates.has(name) ||
+            commands.some((command) => other.index.raw.has(command)));
+        if (consumer) {
+            unused.push(indirect(entry, `used by the workspace package ${consumer.packageName}`));
+            continue;
+        }
+        if (bundled.has(name)) {
+            unused.push(indirect(entry, "listed in bundledDependencies, so it ships with the package"));
+            continue;
+        }
+        // Nothing found. How sure is that?
+        const reasons = [];
+        if (entry.section === "optionalDependencies") {
+            reasons.push("an optional dependency, usually a platform-specific or conditionally loaded package");
+        }
+        if (installedManifest === undefined) {
+            reasons.push("not installed here, so its commands and peer links could not be read");
+        }
+        if (commands.length > 0) {
+            reasons.push(`provides the command${commands.length > 1 ? "s" : ""} ${commands.map((command) => `"${command}"`).join(", ")}, which no script, config or workflow here runs (it may be run by hand or from outside the repository)`);
+        }
+        if (PLUGIN_STYLE.test(name)) {
+            reasons.push("a plugin, preset, loader or config package, which tools load by name from configuration the scan did not find it in");
+        }
+        if (typesFor === "node") {
+            reasons.push("Node's types, but no TypeScript file or tsconfig was found");
+        }
+        if (usage.dynamicLoadFiles.length > 0) {
+            reasons.push(`${usage.dynamicLoadFiles.length} file(s) load modules by a name only known at runtime, which could load it`);
+        }
+        if (usage.unparsedFiles.length > 0) {
+            reasons.push(`${usage.unparsedFiles.length} file(s) could not be fully read, and might import it`);
+        }
+        const sourceInWorkspace = usage.sourceFiles > 0 ||
+            (context.elsewhere ?? []).some((other) => other.usage.sourceFiles > 0);
+        if (!sourceInWorkspace) {
+            reasons.push("no source files were found, so usage cannot be judged");
+        }
+        pending.push({ entry, reasons });
+    }
+    for (const { entry, reasons } of pending) {
+        unused.push({
+            name: entry.name,
+            section: entry.section,
+            range: entry.range,
+            classification: reasons.length === 0 ? "certainly-unused" : "probably-unused",
+            reason: reasons.length === 0 ? BASE_REASON : reasons.join("; "),
+        });
+    }
+    // `@types/x` follows `x`: used if x is, unused if x is, unknown if x is not here at all.
+    const classified = new Map(unused.map((entry) => [entry.name, entry.classification]));
+    for (const { entry, target } of typeEntries) {
+        const targetClass = classified.get(target);
+        const targetUsed = usage.references.has(target) ||
+            usage.mentions.has(target) ||
+            index.candidates.has(target) ||
+            used.includes(target);
+        const base = { name: entry.name, section: entry.section, range: entry.range };
+        if (targetUsed || targetClass === "used-indirectly") {
+            unused.push({
+                ...base,
+                classification: "used-indirectly",
+                reason: `type declarations for ${target}, which this package uses`,
+            });
+        }
+        else if (targetClass === "certainly-unused") {
+            unused.push({
+                ...base,
+                classification: "certainly-unused",
+                reason: `type declarations for ${target}, which is itself unused`,
+            });
+        }
+        else if (targetClass === "probably-unused") {
+            unused.push({
+                ...base,
+                classification: "probably-unused",
+                reason: `type declarations for ${target}, which is itself probably unused`,
+            });
+        }
+        else {
+            unused.push({
+                ...base,
+                classification: "probably-unused",
+                reason: `type declarations for ${target}, which is neither declared nor imported here; global-type packages (a test runner's) apply without an import`,
+            });
+        }
+    }
+    unused.sort((left, right) => left.name.localeCompare(right.name));
+    return { used, unused, dependenciesInstalled };
+}
+//# sourceMappingURL=unused.js.map