checkly 8.23.0 → 8.23.1

package/dist/services/check-parser/package-prune.js

@@ -1,6 +1,7 @@
 import { isDeepStrictEqual } from 'node:util';
 import Debug from 'debug';
-import { parsePackageNamePattern, patternsSelectName, } from '../embedded-packages/spec.js';
+import { quotedList } from '../embedded-packages/diagnostics.js';
+import { parsePackageNamePattern, patternsSelectName, specMatchesPackageName, } from '../embedded-packages/spec.js';
 const debug = Debug('checkly:cli:services:check-parser:package-prune');
 export const DEPENDENCY_CLASSES = [
     'dependencies',
@@ -9,35 +10,41 @@ export const DEPENDENCY_CLASSES = [
     'optionalDependencies',
 ];
 const SHAPE_ERROR = `must be an array of package name patterns or an object keyed by dependency class`;
+const ENTRY_SHAPE_ERROR = `each entry must be a package name pattern`
+    + ` or a member-scoped object with 'member' and one of 'remove' or 'keep'`;
+const CATCH_ALL_PATTERN = parsePackageNamePattern('**');
+function isPlainObject(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        return false;
+    }
+    // A non-plain object (a Set, a Map, a Date) has no own enumerable
+    // string keys, so without this check it would silently normalize to
+    // "nothing to do" instead of being rejected.
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
 /**
- * Validates and normalizes a `bundle.packages.prune` value. Returns
- * `undefined` when there is nothing to do — the value is absent, or every
- * shape it carries is empty. Throws `InvalidPackageNamePatternError` on an
- * invalid pattern and a plain `Error` on an invalid shape; the config
- * loader relies on that to reject plain-JS configs that bypass the
- * TypeScript type.
+ * Parses one element of a pattern list. A plain-object element gets a
+ * pointed rejection: the likely mistake is a member-scoped entry nested
+ * inside a class-keyed map or another entry's selection, which would
+ * otherwise fail as an unreadable `'[object Object]' is not a valid
+ * pattern`. Anything else — arrays included, which the hint would only
+ * misdirect — falls through to the generic pattern error.
  */
-export function normalizePackagePrune(raw) {
-    if (raw === undefined) {
-        return undefined;
-    }
-    let perClass;
-    if (Array.isArray(raw)) {
-        perClass = Object.fromEntries(DEPENDENCY_CLASSES.map(dependencyClass => [dependencyClass, raw]));
-    }
-    else if (raw !== null && typeof raw === 'object') {
-        // A non-plain object (a Set, a Map, a Date) has no own enumerable
-        // string keys, so without this check it would silently normalize to
-        // "nothing to do" instead of being rejected.
-        const proto = Object.getPrototypeOf(raw);
-        if (proto !== Object.prototype && proto !== null) {
-            throw new Error(SHAPE_ERROR);
-        }
-        perClass = raw;
-    }
-    else {
-        throw new Error(SHAPE_ERROR);
+function parseNamePatternEntry(entry, context) {
+    if (isPlainObject(entry)) {
+        throw new Error(`'${context}' entries must be package name patterns`
+            + ` (member-scoped objects are only valid in the top-level prune array)`);
     }
+    return parsePackageNamePattern(entry);
+}
+/**
+ * Validates and normalizes a class-keyed pattern map. `true` values are
+ * kept as `true` for the standalone class-keyed form and desugared to the
+ * catch-all `'**'` pattern inside member-scoped entries, where selections
+ * compose in listed order and a later exclusion may subtract from them.
+ */
+function normalizeClassMap(perClass, desugarTrue) {
     const normalized = {};
     for (const [key, value] of Object.entries(perClass)) {
         if (!DEPENDENCY_CLASSES.includes(key)) {
@@ -47,7 +54,7 @@ export function normalizePackagePrune(raw) {
             continue;
         }
         if (value === true) {
-            normalized[key] = true;
+            normalized[key] = desugarTrue ? [CATCH_ALL_PATTERN] : true;
             continue;
         }
         if (Array.isArray(value)) {
@@ -57,19 +64,402 @@ export function normalizePackagePrune(raw) {
             // Parsed per class even for the array shape, so no two classes share
             // one pattern array instance and a consumer mutating one cannot
             // silently change the others.
-            normalized[key] = value.map(entry => parsePackageNamePattern(entry));
+            normalized[key] = value.map(entry => parseNamePatternEntry(entry, key));
             continue;
         }
         throw new Error(`'${key}' must be true or an array of package name patterns`);
     }
-    if (Object.keys(normalized).length === 0) {
+    return normalized;
+}
+/**
+ * Normalizes a member-scoped `remove`/`keep` value: a flat pattern list
+ * fans out to every dependency class, a class-keyed map stays per class.
+ * For `keep`, an absent class means "keep nothing from it" — so an empty
+ * flat list or map legitimately describes a member kept dependency-free.
+ */
+function normalizeSelection(value, field) {
+    if (Array.isArray(value)) {
+        const patterns = value.map(entry => parseNamePatternEntry(entry, field));
+        if (patterns.length === 0) {
+            return {};
+        }
+        return Object.fromEntries(DEPENDENCY_CLASSES.map(dependencyClass => [dependencyClass, patterns.slice()]));
+    }
+    if (isPlainObject(value)) {
+        // With `true` desugared no `true` values remain, only pattern arrays.
+        return normalizeClassMap(value, true);
+    }
+    throw new Error(`'${field}' ${SHAPE_ERROR}`);
+}
+function normalizeMemberPatterns(raw) {
+    const list = typeof raw === 'string' ? [raw] : raw;
+    if (!Array.isArray(list) || list.length === 0) {
+        throw new Error(`'member' must be a workspace member name pattern or a non-empty array of them`);
+    }
+    return list.map(element => {
+        if (element === '.' || element === '!.') {
+            return { root: true, exclude: element === '!.' };
+        }
+        if (element !== null && typeof element === 'object') {
+            throw new Error(`'member' entries must be member name patterns or the '.' root token`);
+        }
+        return parsePackageNamePattern(element);
+    });
+}
+function normalizeMemberScopedEntry(entry) {
+    if (!isPlainObject(entry)) {
+        throw new Error(ENTRY_SHAPE_ERROR);
+    }
+    for (const key of Object.keys(entry)) {
+        if (key !== 'member' && key !== 'remove' && key !== 'keep') {
+            throw new Error(`'${key}' is not a member-scoped prune entry field (expected member, remove, keep)`);
+        }
+    }
+    const member = normalizeMemberPatterns(entry.member);
+    const hasRemove = entry.remove !== undefined;
+    const hasKeep = entry.keep !== undefined;
+    if (hasRemove === hasKeep) {
+        throw new Error(`a member-scoped prune entry must have exactly one of 'remove' and 'keep'`);
+    }
+    if (hasRemove) {
+        return { kind: 'remove', member, remove: normalizeSelection(entry.remove, 'remove') };
+    }
+    return {
+        kind: 'keep',
+        member,
+        keep: normalizeSelection(entry.keep, 'keep'),
+        flat: Array.isArray(entry.keep),
+    };
+}
+/**
+ * Validates and normalizes a `bundle.packages.prune` value. Returns
+ * `undefined` when there is nothing to do — the value is absent, or every
+ * shape it carries is empty. Throws `InvalidPackageNamePatternError` on an
+ * invalid pattern and a plain `Error` on an invalid shape; the config
+ * loader relies on that to reject plain-JS configs that bypass the
+ * TypeScript type.
+ */
+export function normalizePackagePrune(raw) {
+    if (raw === undefined) {
         return undefined;
     }
-    return normalized;
+    if (Array.isArray(raw)) {
+        const entries = [];
+        for (const entry of raw) {
+            if (typeof entry === 'string') {
+                entries.push({ kind: 'global', pattern: parsePackageNamePattern(entry) });
+                continue;
+            }
+            entries.push(normalizeMemberScopedEntry(entry));
+        }
+        if (entries.length === 0) {
+            return undefined;
+        }
+        return { form: 'entries', entries };
+    }
+    if (!isPlainObject(raw)) {
+        throw new Error(SHAPE_ERROR);
+    }
+    const classes = normalizeClassMap(raw, false);
+    if (Object.keys(classes).length === 0) {
+        return undefined;
+    }
+    return { form: 'classes', classes };
+}
+function memberPatternsSelect(patterns, member) {
+    let selected = false;
+    for (const pattern of patterns) {
+        const matches = 'root' in pattern
+            ? member.root
+            : typeof member.name === 'string' && member.name !== ''
+                && specMatchesPackageName(pattern, member.name);
+        if (matches) {
+            selected = !pattern.exclude;
+        }
+    }
+    return selected;
+}
+/**
+ * Reduces a normalized prune to what applies to the given manifest:
+ * global patterns and matching member-scoped `remove` selections combine
+ * per class in listed order (so a later `!` exclusion subtracts from
+ * earlier entries' selections), unless a `keep` entry matches the member,
+ * in which case the keep selections govern alone. Returns `undefined`
+ * when nothing targets the manifest.
+ */
+export function resolveManifestPrune(prune, member) {
+    if (prune.form === 'classes') {
+        return { mode: 'remove', classes: prune.classes };
+    }
+    const keeps = [];
+    for (const entry of prune.entries) {
+        if (entry.kind === 'keep' && memberPatternsSelect(entry.member, member)) {
+            keeps.push(entry.keep);
+        }
+    }
+    if (keeps.length > 0) {
+        return { mode: 'keep', keeps };
+    }
+    const classes = {};
+    const append = (dependencyClass, patterns) => {
+        (classes[dependencyClass] ??= []).push(...patterns);
+    };
+    for (const entry of prune.entries) {
+        if (entry.kind === 'global') {
+            for (const dependencyClass of DEPENDENCY_CLASSES) {
+                append(dependencyClass, [entry.pattern]);
+            }
+            continue;
+        }
+        if (entry.kind === 'remove' && memberPatternsSelect(entry.member, member)) {
+            for (const dependencyClass of DEPENDENCY_CLASSES) {
+                const patterns = entry.remove[dependencyClass];
+                if (patterns !== undefined) {
+                    append(dependencyClass, patterns);
+                }
+            }
+        }
+    }
+    if (Object.keys(classes).length === 0) {
+        return undefined;
+    }
+    return { mode: 'remove', classes };
+}
+/** Formats a member pattern back to its config spelling. */
+function formatMemberPattern(pattern) {
+    return `${pattern.exclude ? '!' : ''}${'root' in pattern ? '.' : pattern.name}`;
+}
+/**
+ * How a member is named in warnings. Only the root can lack a `name` at
+ * runtime (see {@link PruneMemberIdentity.name}), so its token stands in.
+ */
+function displayMemberName(member) {
+    return member.name ?? '.';
+}
+/**
+ * Whether the pattern contributes anything to the manifest's kept set:
+ * some entry in one of the given classes both matches the pattern and is
+ * ultimately retained — judged against the union of every keep entry
+ * matching the member, exactly what {@link applyPrune} keeps. Judged
+ * against retention rather than the raw match so a keep list whose later
+ * `!` exclusions cancel everything a pattern selected still reports
+ * (that silent gutting is exactly what this net exists to catch), while
+ * a name another matching keep entry rescues does not.
+ */
+function patternReaches(pattern, keeps, parsed, dependencyClasses) {
+    return dependencyClasses.some(dependencyClass => {
+        const section = parsed[dependencyClass];
+        return isPlainSection(section) && Object.keys(section).some(name => specMatchesPackageName(pattern, name) && keepsSelectName(keeps, dependencyClass, name));
+    });
+}
+/**
+ * Lints member-scoped prune entries. Two nets, both warnings rather than
+ * errors because a pattern reaching nothing is legal in every other
+ * `bundle.packages` position: a `member` selector matching no workspace
+ * member at all (typo net), and a `keep` pattern selecting nothing in a
+ * matched bundled member (the auto-enrollment net — a member swept in by
+ * a wildcard later almost never declares another member's keep set, so
+ * the gutting self-reports on the next run; a right name in the wrong
+ * class reports the same way). The typo net is judged against the whole
+ * discovered workspace, not the bundle: which members land in a bundle
+ * varies per run with the check filter (`checkly test --grep`, a single
+ * `checkly pw-test` config), and a selector for a member the current run
+ * merely did not bundle is not a typo — that state shows up in the debug
+ * reach log instead. The keep net runs on the bundled physical manifests
+ * only — faux shims carry no real dependency classes — and only on ones
+ * the caller could read, so a symlinked or unreadable manifest's own
+ * failure warns separately.
+ */
+export class MemberPruneDiagnostics {
+    /** One record per scoped entry, in entry order. */
+    #state = [];
+    /**
+     * Keep misses keyed by entry, place and pattern, accumulating the
+     * missing members: a shared keep list over a wildcard selector then
+     * warns once per pattern naming every member it missed, instead of
+     * bursting one line per member on every run.
+     */
+    #keepMisses = new Map();
+    constructor(prune) {
+        if (prune?.form === 'entries') {
+            this.#state = prune.entries
+                .filter(entry => entry.kind !== 'global')
+                .map(entry => ({ entry, workspaceMatched: new Set(), bundledMatched: new Set() }));
+        }
+    }
+    /**
+     * Marks the scoped entries whose member selector selects this workspace
+     * member, bundled or not — the input of the typo net.
+     */
+    observeWorkspaceMember(member) {
+        for (const state of this.#state) {
+            if (memberPatternsSelect(state.entry.member, member)) {
+                state.workspaceMatched.add(displayMemberName(member));
+            }
+        }
+    }
+    /**
+     * Marks the scoped entries whose member selector selects this bundled
+     * physical manifest — the input of the debug reach log.
+     */
+    observeBundledMember(member) {
+        for (const state of this.#state) {
+            if (memberPatternsSelect(state.entry.member, member)) {
+                state.bundledMatched.add(displayMemberName(member));
+            }
+        }
+    }
+    /** Checks matching keep selections against the manifest's contents. */
+    observeManifestContent(member, content) {
+        let parsed;
+        try {
+            parsed = JSON.parse(content);
+        }
+        catch {
+            return;
+        }
+        if (!isPlainSection(parsed)) {
+            return;
+        }
+        // Reach is judged against the union of every matching keep entry —
+        // the member's actual retention — so an entry's pattern whose kept
+        // names another entry supplies does not misreport.
+        const matched = [];
+        const keeps = [];
+        for (const [index, state] of this.#state.entries()) {
+            if (state.entry.kind === 'keep' && memberPatternsSelect(state.entry.member, member)) {
+                matched.push({ index, entry: state.entry });
+                keeps.push(state.entry.keep);
+            }
+        }
+        for (const { index, entry } of matched) {
+            this.#checkKeepEntry(index, entry, keeps, member, parsed);
+        }
+    }
+    #checkKeepEntry(entryIndex, entry, keeps, member, parsed) {
+        const memberName = displayMemberName(member);
+        const check = (patterns, classes, where) => {
+            for (const pattern of patterns) {
+                if (this.#exemptFromMatchCheck(pattern)) {
+                    continue;
+                }
+                if (!patternReaches(pattern, keeps, parsed, classes)) {
+                    const key = `${entryIndex}\u0000${where}\u0000${pattern.name}`;
+                    let miss = this.#keepMisses.get(key);
+                    if (miss === undefined) {
+                        this.#keepMisses.set(key, miss = { pattern: pattern.name, where, members: [] });
+                    }
+                    if (!miss.members.includes(memberName)) {
+                        miss.members.push(memberName);
+                    }
+                }
+            }
+        };
+        if (entry.flat) {
+            // A flat list fans out to every class identically, so its patterns
+            // are checked across all classes and warn once — a per-class report
+            // would repeat every miss four times.
+            check(entry.keep.dependencies ?? [], DEPENDENCY_CLASSES, 'any dependency class');
+            return;
+        }
+        for (const dependencyClass of DEPENDENCY_CLASSES) {
+            check(entry.keep[dependencyClass] ?? [], [dependencyClass], dependencyClass);
+        }
+    }
+    /**
+     * Exclusions only subtract, so one deselecting nothing is benign — the
+     * same rule embed applies. The bare catch-all is exempt too: it is what
+     * `keep: { <class>: true }` desugars to, and "everything in an empty
+     * class" matching nothing is not a signal worth a warning.
+     */
+    #exemptFromMatchCheck(pattern) {
+        return pattern.exclude || pattern.name === '**';
+    }
+    #selector(entry) {
+        return entry.member.map(formatMemberPattern).join(`', '`);
+    }
+    /**
+     * Logs each scoped entry's resolved member set — workspace-wide and
+     * within this run's bundle — mirroring embed's pattern reach logging.
+     * This is also where "the selector is fine, the member just is not in
+     * this bundle" is visible. A separate call rather than a side effect of
+     * {@link MemberPruneDiagnostics.warnings}: a caller that gates or drops
+     * the warnings must not silently lose the reach log, which is the tool
+     * for answering the very question the warnings raise.
+     */
+    logMemberReach() {
+        for (const { entry, workspaceMatched, bundledMatched } of this.#state) {
+            debug(`Prune entry for member '${this.#selector(entry)}' matched workspace members:`
+                + ` ${[...workspaceMatched].join(', ') || '(none)'};`
+                + ` bundled: ${[...bundledMatched].join(', ') || '(none)'}`);
+        }
+    }
+    /** The accumulated lint messages, without the `Warning:` prefix. */
+    warnings() {
+        const out = [];
+        for (const { entry, workspaceMatched } of this.#state) {
+            if (workspaceMatched.size === 0) {
+                out.push(`bundle.packages.prune entry for member '${this.#selector(entry)}'`
+                    + ` matched no workspace member`);
+            }
+        }
+        for (const { pattern, where, members } of this.#keepMisses.values()) {
+            const consequence = members.length > 1
+                ? 'their bundled manifests do not keep it'
+                : 'its bundled manifest does not keep it';
+            out.push(`bundle.packages.prune keep pattern '${pattern}' matched nothing`
+                + ` in ${where} of ${quotedList(members)}; ${consequence}`);
+        }
+        return out;
+    }
 }
 function isPlainSection(section) {
     return section !== null && typeof section === 'object' && !Array.isArray(section);
 }
+/** Whether any of the matched keep selections keeps the given entry. */
+function keepsSelectName(keeps, dependencyClass, name) {
+    return keeps.some(keep => {
+        const patterns = keep[dependencyClass];
+        return patterns !== undefined && patternsSelectName(patterns, name);
+    });
+}
+/**
+ * Deletes the class's entries the predicate selects, recording removals
+ * as `class:name` labels. Carries the structural rules shared by both
+ * prune modes: a removed peer takes its `peerDependenciesMeta` entry with
+ * it, and a section or meta object emptied by these removals is deleted —
+ * one that was already empty is none of this feature's business.
+ */
+function removeSelectedNames(parsed, dependencyClass, selects, removed) {
+    const section = parsed[dependencyClass];
+    if (!isPlainSection(section)) {
+        return false;
+    }
+    let lost = false;
+    for (const name of Object.keys(section)) {
+        if (!selects(name)) {
+            continue;
+        }
+        delete section[name];
+        removed.push(`${dependencyClass}:${name}`);
+        lost = true;
+        if (dependencyClass === 'peerDependencies') {
+            const meta = parsed.peerDependenciesMeta;
+            if (isPlainSection(meta)) {
+                delete meta[name];
+            }
+        }
+    }
+    if (lost && Object.keys(section).length === 0) {
+        delete parsed[dependencyClass];
+    }
+    if (lost && dependencyClass === 'peerDependencies'
+        && isPlainSection(parsed.peerDependenciesMeta)
+        && Object.keys(parsed.peerDependenciesMeta).length === 0) {
+        delete parsed.peerDependenciesMeta;
+    }
+    return lost;
+}
 /**
  * Deletes the pruned entries from a parsed manifest, recording removals as
  * `class:name` labels. The verification below replays the same edit from
@@ -78,21 +468,27 @@ function isPlainSection(section) {
  * not a plain object is never touched; `true` deletes the class (and, for
  * `peerDependencies`, the whole `peerDependenciesMeta`); a removed peer
  * takes its meta entry with it; and a section or meta object emptied by
- * these removals is deleted. `dependenciesMeta` is deliberately not
- * followed: only the peer meta matters for the auto-install-peers
- * promotion this feature exists to counter, and a dangling
- * `dependenciesMeta` entry is inert for the regenerated lockfile.
+ * these removals is deleted. In keep mode the selection inverts — an entry
+ * no matched keep selects is removed — under the same structural rules.
+ * `dependenciesMeta` is deliberately not followed: only the peer meta
+ * matters for the auto-install-peers promotion this feature exists to
+ * counter, and a dangling `dependenciesMeta` entry is inert for the
+ * regenerated lockfile.
  */
-function applyPrune(parsed, prune) {
+function applyPrune(parsed, resolved) {
     const removed = [];
     let changed = false;
     for (const dependencyClass of DEPENDENCY_CLASSES) {
-        const matcher = prune[dependencyClass];
+        if (resolved.mode === 'keep') {
+            changed = removeSelectedNames(parsed, dependencyClass, name => !keepsSelectName(resolved.keeps, dependencyClass, name), removed) || changed;
+            continue;
+        }
+        const matcher = resolved.classes[dependencyClass];
         if (matcher === undefined) {
             continue;
         }
-        const section = parsed[dependencyClass];
         if (matcher === true) {
+            const section = parsed[dependencyClass];
             if (isPlainSection(section)) {
                 for (const name of Object.keys(section)) {
                     removed.push(`${dependencyClass}:${name}`);
@@ -110,47 +506,19 @@ function applyPrune(parsed, prune) {
             }
             continue;
         }
-        if (!isPlainSection(section)) {
-            continue;
-        }
-        let lost = false;
-        for (const name of Object.keys(section)) {
-            if (!patternsSelectName(matcher, name)) {
-                continue;
-            }
-            delete section[name];
-            removed.push(`${dependencyClass}:${name}`);
-            changed = true;
-            lost = true;
-            if (dependencyClass === 'peerDependencies') {
-                const meta = parsed.peerDependenciesMeta;
-                if (isPlainSection(meta)) {
-                    delete meta[name];
-                }
-            }
-        }
-        // Only a section (or meta object) this pass emptied is dropped; one
-        // that was already empty is none of this feature's business.
-        if (lost && Object.keys(section).length === 0) {
-            delete parsed[dependencyClass];
-        }
-        if (lost && dependencyClass === 'peerDependencies'
-            && isPlainSection(parsed.peerDependenciesMeta)
-            && Object.keys(parsed.peerDependenciesMeta).length === 0) {
-            delete parsed.peerDependenciesMeta;
-        }
+        changed = removeSelectedNames(parsed, dependencyClass, name => patternsSelectName(matcher, name), removed) || changed;
     }
     return { removed, changed };
 }
 /**
- * Applies a normalized `bundle.packages.prune` to a package.json's
- * contents. Returns the rewritten content and the removed entries, or
- * `undefined` when the content cannot be parsed or the rewrite fails
- * verification — the caller ships the original in that case. A prune that
- * changes nothing returns the original content with `changed: false`, so
- * the caller can leave the bundle entry untouched.
+ * Applies a resolved per-manifest prune (see {@link resolveManifestPrune})
+ * to a package.json's contents. Returns the rewritten content and the
+ * removed entries, or `undefined` when the content cannot be parsed or the
+ * rewrite fails verification — the caller ships the original in that case.
+ * A prune that changes nothing returns the original content with
+ * `changed: false`, so the caller can leave the bundle entry untouched.
  */
-export function prunePackageJson(content, prune) {
+export function prunePackageJson(content, resolved) {
     let parsed;
     try {
         parsed = JSON.parse(content);
@@ -163,7 +531,7 @@ export function prunePackageJson(content, prune) {
         debug(`Refusing to prune a package.json that is not an object`);
         return undefined;
     }
-    const { removed, changed } = applyPrune(parsed, prune);
+    const { removed, changed } = applyPrune(parsed, resolved);
     if (!changed) {
         return { content, removed, changed };
     }
@@ -172,7 +540,7 @@ export function prunePackageJson(content, prune) {
     // text — and matching the original's formatting would mean carrying a
     // JSON editor for no behavioral gain.
     const rewritten = JSON.stringify(parsed, null, 2);
-    if (verifyPrunedManifest(content, rewritten, prune, removed) === undefined) {
+    if (verifyPrunedManifest(content, rewritten, resolved, removed) === undefined) {
         return undefined;
     }
     return { content: rewritten, removed, changed };
@@ -181,13 +549,16 @@ export function prunePackageJson(content, prune) {
  * Asserts that a prune rewrite changed nothing but the reported entries,
  * by replaying the deletion on a fresh parse of the original — from the
  * `class:name` labels rather than the pattern matching, with each label
- * additionally checked against the configured prune — so a matcher that
+ * additionally checked against the resolved prune — so a matcher that
  * deleted the wrong entry, deleted from a class the prune never
- * configured, or strayed outside the dependency classes fails the
- * comparison instead of shipping. The structural rules (`true` deleting a
- * class, emptied sections and meta dropping out) are mirrored from
- * applyPrune rather than independently derived, so only the per-entry
- * path carries independent evidence; a maintainer extending the
+ * configured, deleted a keep-selected entry, or strayed outside the
+ * dependency classes fails the comparison instead of shipping. The
+ * verification is inherently per manifest — its inputs are one manifest's
+ * original and rewrite — so the resolved model already carries any member
+ * scoping and the labels need no member qualifier. The structural rules
+ * (`true` deleting a class, emptied sections and meta dropping out) are
+ * mirrored from applyPrune rather than independently derived, so only the
+ * per-entry path carries independent evidence; a maintainer extending the
  * structural rules must extend both sides. What the comparison cannot see
  * is a field whose value is already altered by JSON.parse itself (an
  * integer beyond 2^53 loses precision on both sides alike); asymmetric
@@ -196,7 +567,7 @@ export function prunePackageJson(content, prune) {
  * fail-closed verifier in patched-dependencies.ts (`verifyRewrite`);
  * hardening either against a manifest quirk likely applies to both.
  */
-export function verifyPrunedManifest(original, rewritten, prune, removed) {
+export function verifyPrunedManifest(original, rewritten, resolved, removed) {
     let expected;
     let actual;
     try {
@@ -207,18 +578,25 @@ export function verifyPrunedManifest(original, rewritten, prune, removed) {
         debug(`Could not reparse a pruned package.json for verification: ${err}`);
         return undefined;
     }
+    const classTrue = (dependencyClass) => resolved.mode === 'remove' && resolved.classes[dependencyClass] === true;
+    // Whether the resolved prune selects the entry for removal. Only called
+    // with the known dependency classes — the caller checks membership
+    // first, so a label like `__proto__:x` fails closed instead of reading
+    // a matcher off Object.prototype.
+    const selectsRemoval = (dependencyClass, name) => {
+        if (resolved.mode === 'keep') {
+            return !keepsSelectName(resolved.keeps, dependencyClass, name);
+        }
+        const matcher = resolved.classes[dependencyClass];
+        return matcher !== undefined && (matcher === true || patternsSelectName(matcher, name));
+    };
     // Every reported removal must be one the configuration allows: its class
-    // a known dependency class the prune configured, and its name selected
-    // by `true` or a configured pattern. The class-membership check comes
-    // first so a label like `__proto__:x` fails closed instead of reading a
-    // matcher off Object.prototype.
+    // a known dependency class, and its name one the resolved prune selects.
     for (const label of removed) {
         const separator = label.indexOf(':');
         const dependencyClass = label.slice(0, separator);
         const name = label.slice(separator + 1);
-        const matcher = DEPENDENCY_CLASSES.includes(dependencyClass) ? prune[dependencyClass] : undefined;
-        if (matcher === undefined
-            || (matcher !== true && !patternsSelectName(matcher, name))) {
+        if (!DEPENDENCY_CLASSES.includes(dependencyClass) || !selectsRemoval(dependencyClass, name)) {
             debug(`A pruned package.json removed '${label}', which the configuration does not select;`
                 + ` leaving the bundle alone`);
             return undefined;
@@ -238,7 +616,7 @@ export function verifyPrunedManifest(original, rewritten, prune, removed) {
         }
         delete section[name];
         lostClasses.add(dependencyClass);
-        if (dependencyClass === 'peerDependencies' && prune.peerDependencies !== true) {
+        if (dependencyClass === 'peerDependencies' && !classTrue('peerDependencies')) {
             lostPeers = true;
             const meta = expected.peerDependenciesMeta;
             if (isPlainSection(meta)) {
@@ -247,7 +625,7 @@ export function verifyPrunedManifest(original, rewritten, prune, removed) {
         }
     }
     for (const dependencyClass of DEPENDENCY_CLASSES) {
-        if (prune[dependencyClass] === true) {
+        if (classTrue(dependencyClass)) {
             if (isPlainSection(expected[dependencyClass])) {
                 delete expected[dependencyClass];
             }