depvitals 0.0.1 → 0.1.1

package/dist/core/analyzeProject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzeProject.d.ts","sourceRoot":"","sources":["../../src/core/analyzeProject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAUH;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,uDAAuD;IACvD,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,+FAA+F;IAC/F,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,GAAG,gBAAgB,CAAC;AAEvE;;;;;;;GAOG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;gBAErB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,EAAE,OAAO;CAKtE;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CA6CjF"}

package/dist/core/analyzeProject.js

@@ -0,0 +1,175 @@
+/**
+ * Dependency analysis.
+ *
+ * This module combines the outputs of the manifest loader, source discovery, module-specifier
+ * extraction, package-specifier classification and script-usage detection into the first real
+ * dependency-analysis engine.
+ *
+ * It answers exactly three questions about a single Node.js project:
+ * - which `dependencies` are never referenced (neither by source files nor by `package.json`
+ *   scripts)?
+ * - which `devDependencies` are never referenced?
+ * - which external packages are referenced by source files but are not declared anywhere?
+ *
+ * It deliberately does not:
+ * - decide whether a dependency is misplaced, a misconfigured peer/optional, or a scoped
+ *   dependency (that belongs to later releases);
+ * - resolve specifiers against `node_modules`, `tsconfig` `paths`, `package.json#imports` or
+ *   bundler aliases (Step 10 only classifies a raw specifier);
+ * - render terminal output, JSON, evidence or confidence (that belongs to later steps);
+ * - execute or import any analyzed source, run package scripts, or mutate the analyzed project;
+ * - consult the network or the npm registry.
+ *
+ * The pipeline is intentionally sequential and single-pass: each discovered source file is read
+ * once and parsed once. No concurrency pool, cache or index is introduced before a measured need
+ * appears.
+ *
+ * Usage/missing formulas (`usedNames` is the union of source-external package roots and script-used
+ * package names; `declaredDependencyNames` is the union of every declared dependency section):
+ *
+ * ```text
+ * sourceUsedNames = external package roots extracted from source files
+ * scriptUsedNames = findPackageScriptUsage(scripts, dependencies ∪ devDependencies)
+ * usedNames       = sourceUsedNames ∪ scriptUsedNames
+ * unusedDependencies    = dependencies    − usedNames
+ * unusedDevDependencies = devDependencies − usedNames
+ * missingDependencies   = sourceUsedNames − declaredDependencyNames
+ * ```
+ *
+ * Scripts never generate missing-dependency findings, and peer/optional declarations suppress false
+ * missing results through `declaredDependencyNames`.
+ */
+import { readFile } from 'node:fs/promises';
+import { loadProjectManifest } from '../scanner/projectManifest.js';
+import { discoverSourceFiles } from '../scanner/sourceFiles.js';
+import { extractModuleSpecifiers } from '../scanner/moduleSpecifiers.js';
+import { classifyPackageSpecifier } from '../scanner/packageSpecifier.js';
+import { findPackageScriptUsage } from '../scanner/scriptUsage.js';
+/**
+ * Operational error for the dependency-analysis engine.
+ *
+ * The `code` lets callers (the CLI in a later step) render a clean message without matching on error
+ * strings, and the preserved `cause` keeps the original filesystem or parsing failure. The affected
+ * source-file path is always included in the message so an unreadable or invalid file is never
+ * silently skipped.
+ */
+export class AnalysisError extends Error {
+    code;
+    constructor(message, code, cause) {
+        super(message, cause === undefined ? undefined : { cause });
+        this.name = 'AnalysisError';
+        this.code = code;
+    }
+}
+/**
+ * Analyze the single project rooted at `projectRoot` and return the structured unused/missing result.
+ *
+ * The supplied root is resolved to an absolute path; `process.cwd()` is never changed and the target
+ * project is never written to.
+ *
+ * @throws {AnalysisError} when a discovered source file cannot be read or cannot be safely analyzed.
+ * @throws {ProjectManifestError} when the manifest is missing, unreadable, invalid or malformed.
+ * @throws {SourceFilesError} when the root is missing, is not a directory, or cannot be read.
+ */
+export async function analyzeProject(projectRoot) {
+    const manifest = await loadProjectManifest(projectRoot);
+    const sourceFiles = await discoverSourceFiles(manifest.root);
+    // External package roots referenced by source files, collapsed to their package root.
+    const sourceUsedNames = new Set();
+    for (const file of sourceFiles) {
+        const specifiers = await readAndExtract(file);
+        for (const specifier of specifiers) {
+            const classified = classifyPackageSpecifier(specifier);
+            if (classified.kind === 'external') {
+                sourceUsedNames.add(classified.packageName);
+            }
+        }
+    }
+    // Script usage is only meaningful for the packages that may be reported as unused: dependencies
+    // and devDependencies. Peer/optional declarations are excluded from this input by design.
+    const declaredCandidates = unionNames([
+        Object.keys(manifest.dependencies),
+        Object.keys(manifest.devDependencies),
+    ]);
+    const scriptUsedNames = findPackageScriptUsage(manifest.scripts, declaredCandidates);
+    const usedNames = unionNames([[...sourceUsedNames], [...scriptUsedNames]]);
+    const unusedDependencies = declaredMinus(Object.keys(manifest.dependencies), usedNames);
+    const unusedDevDependencies = declaredMinus(Object.keys(manifest.devDependencies), usedNames);
+    // An external root is missing only when it is absent from every declared dependency section.
+    // Peer/optional declarations therefore suppress false missing results.
+    const missingDependencies = declaredMinus([...sourceUsedNames], manifest.declaredDependencyNames);
+    return {
+        projectRoot: manifest.root,
+        unusedDependencies,
+        unusedDevDependencies,
+        missingDependencies,
+    };
+}
+/**
+ * Read a discovered source file and extract its statically known specifiers.
+ *
+ * A filesystem read failure becomes {@link AnalysisError} with code `unreadable-source`; a lexical
+ * failure from the specifier extractor becomes {@link AnalysisError} with code `invalid-source`. Both
+ * preserve the original error as `cause` and include the affected path, so a broken file never
+ * yields a partial result or a misleading "clean" analysis.
+ */
+async function readAndExtract(file) {
+    let source;
+    try {
+        source = await readFile(file, 'utf8');
+    }
+    catch (error) {
+        throw new AnalysisError(`Could not read source file ${file}: ${messageOf(error)}`, 'unreadable-source', error);
+    }
+    try {
+        const occurrences = extractModuleSpecifiers(source);
+        return occurrences.map((occurrence) => occurrence.specifier);
+    }
+    catch (error) {
+        if (error instanceof Error && error.name === 'ModuleSpecifierError') {
+            throw new AnalysisError(`Source file ${file} could not be analyzed: ${messageOf(error)}`, 'invalid-source', error);
+        }
+        throw error;
+    }
+}
+/**
+ * Union of the names of every supplied list, sorted alphabetically.
+ */
+function unionNames(lists) {
+    const names = new Set();
+    for (const list of lists) {
+        for (const name of list) {
+            names.add(name);
+        }
+    }
+    return new Set([...names].sort(compareNames));
+}
+/**
+ * The sorted names of `declared` that are not contained in `used`.
+ */
+function declaredMinus(declared, used) {
+    const unused = declared.filter((name) => !used.has(name));
+    return [...new Set(unused)].sort(compareNames);
+}
+/**
+ * A short, human-readable reason extracted from an unknown thrown value, for error messages only.
+ */
+function messageOf(error) {
+    if (error instanceof Error) {
+        return error.message;
+    }
+    return String(error);
+}
+/**
+ * Locale-independent lexicographic ordering, so the same project always yields the same order.
+ */
+function compareNames(a, b) {
+    if (a < b) {
+        return -1;
+    }
+    if (a > b) {
+        return 1;
+    }
+    return 0;
+}
+//# sourceMappingURL=analyzeProject.js.map

package/dist/core/analyzeProject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzeProject.js","sourceRoot":"","sources":["../../src/core/analyzeProject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AA+BnE;;;;;;;GAOG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,CAAoB;IAEjC,YAAY,OAAe,EAAE,IAAuB,EAAE,KAAe;QACnE,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,WAAmB;IACtD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAExD,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7D,sFAAsF;IACtF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAE9C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAEvD,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACnC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IAED,gGAAgG;IAChG,0FAA0F;IAC1F,MAAM,kBAAkB,GAAG,UAAU,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;KACtC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAErF,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAE3E,MAAM,kBAAkB,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;IAExF,MAAM,qBAAqB,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC,CAAC;IAE9F,6FAA6F;IAC7F,uEAAuE;IACvE,MAAM,mBAAmB,GAAG,aAAa,CAAC,CAAC,GAAG,eAAe,CAAC,EAAE,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAElG,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,IAAI;QAC1B,kBAAkB;QAClB,qBAAqB;QACrB,mBAAmB;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,IAAI,MAAc,CAAC;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,aAAa,CACrB,8BAA8B,IAAI,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,EACzD,mBAAmB,EACnB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACpE,MAAM,IAAI,aAAa,CACrB,eAAe,IAAI,2BAA2B,SAAS,CAAC,KAAK,CAAC,EAAE,EAChE,gBAAgB,EAChB,KAAK,CACN,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,KAAqC;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,QAA2B,EAAE,IAAyB;IAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/reporters/terminalReporter.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Deterministic terminal reporter.
+ *
+ * Renders an {@link AnalysisResult} as plain terminal text and nothing else: the module performs no
+ * process I/O, never imports `node:process`, never writes to a stream, never assigns an exit code,
+ * and never reads the filesystem. It is a pure `AnalysisResult -> string` transformation, so the
+ * exact output is fully testable and can be reused by any future presentation layer.
+ *
+ * The `v0.1.0` output is intentionally plain. It contains exactly:
+ * - the `DepVitals` heading;
+ * - one section per non-empty findings category, in a fixed order;
+ * - the clean-project message when there are no findings at all.
+ *
+ * It deliberately does not contain colors, symbols, spinners, tables, terminal-width detection,
+ * links, prompts, source locations, advice, remediation commands, dependency counts, project paths
+ * or any summary footer. Those belong to later releases, if they are added at all.
+ *
+ * Output contract:
+ * - sections appear in the order `Unused dependencies`, `Unused devDependencies`,
+ *   `Missing dependencies`;
+ * - empty sections are omitted entirely (a `Category (0)` heading is never printed);
+ * - package names are sorted alphabetically inside each section and counted exactly as rendered;
+ * - every package name is indented with exactly two spaces;
+ * - exactly one blank line follows the heading and separates consecutive sections;
+ * - no blank line follows the last section;
+ * - the returned string ends with exactly one `\n`, always LF regardless of platform.
+ *
+ * The reporter guarantees its own ordering by sorting a copy of every findings array with a
+ * private codepoint comparator: it never relies on the caller having sorted the input, never mutates
+ * the received arrays, and never uses locale-sensitive comparison. Deduplication stays the analyzer's
+ * responsibility, so a duplicated name inside a category would be rendered twice by design.
+ */
+import type { AnalysisResult } from '../core/analyzeProject.js';
+/**
+ * Whether the analysis produced at least one unused or missing dependency finding.
+ *
+ * Pure and side-effect free. It reports nothing about process exit codes: deciding when a CLI run
+ * should fail belongs to the caller that owns the process.
+ */
+export declare function hasDependencyIssues(result: AnalysisResult): boolean;
+/**
+ * Render the complete terminal report for `result`, including its single trailing newline.
+ *
+ * @param result - The structured analysis produced by the dependency analyzer.
+ * @returns The full terminal text: the clean message, or the heading followed by the non-empty
+ *   findings sections in deterministic order.
+ */
+export declare function formatTerminalReport(result: AnalysisResult): string;
+//# sourceMappingURL=terminalReporter.d.ts.map

package/dist/reporters/terminalReporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminalReporter.d.ts","sourceRoot":"","sources":["../../src/reporters/terminalReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAchE;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAMnE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAQnE"}

package/dist/reporters/terminalReporter.js

@@ -0,0 +1,98 @@
+/**
+ * Deterministic terminal reporter.
+ *
+ * Renders an {@link AnalysisResult} as plain terminal text and nothing else: the module performs no
+ * process I/O, never imports `node:process`, never writes to a stream, never assigns an exit code,
+ * and never reads the filesystem. It is a pure `AnalysisResult -> string` transformation, so the
+ * exact output is fully testable and can be reused by any future presentation layer.
+ *
+ * The `v0.1.0` output is intentionally plain. It contains exactly:
+ * - the `DepVitals` heading;
+ * - one section per non-empty findings category, in a fixed order;
+ * - the clean-project message when there are no findings at all.
+ *
+ * It deliberately does not contain colors, symbols, spinners, tables, terminal-width detection,
+ * links, prompts, source locations, advice, remediation commands, dependency counts, project paths
+ * or any summary footer. Those belong to later releases, if they are added at all.
+ *
+ * Output contract:
+ * - sections appear in the order `Unused dependencies`, `Unused devDependencies`,
+ *   `Missing dependencies`;
+ * - empty sections are omitted entirely (a `Category (0)` heading is never printed);
+ * - package names are sorted alphabetically inside each section and counted exactly as rendered;
+ * - every package name is indented with exactly two spaces;
+ * - exactly one blank line follows the heading and separates consecutive sections;
+ * - no blank line follows the last section;
+ * - the returned string ends with exactly one `\n`, always LF regardless of platform.
+ *
+ * The reporter guarantees its own ordering by sorting a copy of every findings array with a
+ * private codepoint comparator: it never relies on the caller having sorted the input, never mutates
+ * the received arrays, and never uses locale-sensitive comparison. Deduplication stays the analyzer's
+ * responsibility, so a duplicated name inside a category would be rendered twice by design.
+ */
+/** Heading printed as the first line of every report. */
+const HEADER = 'DepVitals';
+/** Exact report returned when the analysis contains no findings at all. */
+const CLEAN_REPORT = `${HEADER}\n\nNo dependency issues found.\n`;
+/**
+ * Whether the analysis produced at least one unused or missing dependency finding.
+ *
+ * Pure and side-effect free. It reports nothing about process exit codes: deciding when a CLI run
+ * should fail belongs to the caller that owns the process.
+ */
+export function hasDependencyIssues(result) {
+    return (result.unusedDependencies.length > 0 ||
+        result.unusedDevDependencies.length > 0 ||
+        result.missingDependencies.length > 0);
+}
+/**
+ * Render the complete terminal report for `result`, including its single trailing newline.
+ *
+ * @param result - The structured analysis produced by the dependency analyzer.
+ * @returns The full terminal text: the clean message, or the heading followed by the non-empty
+ *   findings sections in deterministic order.
+ */
+export function formatTerminalReport(result) {
+    if (!hasDependencyIssues(result)) {
+        return CLEAN_REPORT;
+    }
+    const sections = findingsSections(result).filter((section) => section.names.length > 0);
+    return `${HEADER}\n\n${sections.map(renderSection).join('\n\n')}\n`;
+}
+/**
+ * The findings categories in their fixed rendering order. Keeping the order here means the section
+ * sequence can never depend on the shape or key order of the incoming result.
+ */
+function findingsSections(result) {
+    return [
+        { heading: 'Unused dependencies', names: result.unusedDependencies },
+        { heading: 'Unused devDependencies', names: result.unusedDevDependencies },
+        { heading: 'Missing dependencies', names: result.missingDependencies },
+    ];
+}
+/**
+ * Render one non-empty section: a heading carrying the number of rendered packages, followed by one
+ * two-space-indented line per package name.
+ *
+ * The count is taken from the sorted copy, so it always matches the lines printed below it.
+ */
+function renderSection(section) {
+    const names = [...section.names].sort(compareNames);
+    const count = String(names.length);
+    return [`${section.heading} (${count})`, ...names.map((name) => `  ${name}`)].join('\n');
+}
+/**
+ * Locale-independent lexicographic (codepoint) ordering, matching the comparator convention already
+ * used by the analyzer. `localeCompare` is deliberately avoided: its result depends on the runtime
+ * locale, which would break deterministic terminal output across machines.
+ */
+function compareNames(a, b) {
+    if (a < b) {
+        return -1;
+    }
+    if (a > b) {
+        return 1;
+    }
+    return 0;
+}
+//# sourceMappingURL=terminalReporter.js.map

package/dist/reporters/terminalReporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminalReporter.js","sourceRoot":"","sources":["../../src/reporters/terminalReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,yDAAyD;AACzD,MAAM,MAAM,GAAG,WAAW,CAAC;AAE3B,2EAA2E;AAC3E,MAAM,YAAY,GAAG,GAAG,MAAM,mCAAmC,CAAC;AAQlE;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAsB;IACxD,OAAO,CACL,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;QACpC,MAAM,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC;QACvC,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CACtC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAsB;IACzD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAExF,OAAO,GAAG,MAAM,OAAO,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,MAAsB;IAC9C,OAAO;QACL,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,kBAAkB,EAAE;QACpE,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,CAAC,qBAAqB,EAAE;QAC1E,EAAE,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,mBAAmB,EAAE;KACvE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,OAAgB;IACrC,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEnC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/scanner/moduleSpecifiers.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Static module specifier extraction.
+ *
+ * This module reads JavaScript/TypeScript source text and returns the statically knowable module
+ * specifiers it contains, without executing the code and without a heavyweight parser dependency.
+ *
+ * It deliberately does not:
+ * - decide whether a specifier is an external package, a Node builtin, relative, missing or used
+ *   (that belongs to later steps);
+ * - normalize specifiers, sort or deduplicate them;
+ * - resolve anything on disk or through path aliases / bundler aliases.
+ *
+ * The occurrences are returned in source encounter order and are not deduplicated: deduplication
+ * belongs to the analysis step, not to extraction.
+ *
+ * Instead of a few global regexes over raw source, this module runs a small lexical scanner with
+ * just enough JavaScript awareness to identify the required forms while ignoring comments, strings,
+ * template literal text and regex literals so they never produce false findings. JavaScript inside
+ * template interpolations (`${...}`) is still lexed, so specifiers there are found.
+ */
+/**
+ * The kind of module construct a specifier came from.
+ */
+export type ModuleSpecifierKind = 'import' | 'export-from' | 'dynamic-import' | 'require';
+/**
+ * A single statically extracted specifier together with the construct that produced it.
+ */
+export type ModuleSpecifierOccurrence = {
+    readonly specifier: string;
+    readonly kind: ModuleSpecifierKind;
+};
+/**
+ * Error code for the module specifier scanner.
+ *
+ * - `invalid-source`: the source reached a lexical state from which the scanner cannot safely
+ *   determine where the current lexical construct ends (an unterminated string/comment/template/
+ *   regex, or a malformed string escape).
+ */
+export type ModuleSpecifierErrorCode = 'invalid-source';
+/**
+ * Operational error for module specifier extraction.
+ *
+ * It is thrown only when the source cannot be scanned safely, so callers (later steps) can treat a
+ * file as un-analysable rather than trusting a partial result.
+ */
+export declare class ModuleSpecifierError extends Error {
+    readonly code: ModuleSpecifierErrorCode;
+    readonly offset: number;
+    constructor(message: string, code: ModuleSpecifierErrorCode, offset: number);
+}
+/**
+ * Extract the statically knowable module specifiers from `source`.
+ *
+ * The returned occurrences preserve source order and are not deduplicated.
+ *
+ * @throws {ModuleSpecifierError} when the source reaches an unterminated or malformed lexical state
+ *   from which the scanner cannot safely continue.
+ */
+export declare function extractModuleSpecifiers(source: string): readonly ModuleSpecifierOccurrence[];
+//# sourceMappingURL=moduleSpecifiers.d.ts.map

package/dist/scanner/moduleSpecifiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"moduleSpecifiers.d.ts","sourceRoot":"","sources":["../../src/scanner/moduleSpecifiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,aAAa,GAAG,gBAAgB,GAAG,SAAS,CAAC;AAE1F;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;CACpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,CAAC;AAExD;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM;CAM5E;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,yBAAyB,EAAE,CAE5F"}