depvitals 0.1.1 → 0.2.0

package/dist/detectors/eslintManifestConfig.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Legacy `package.json#eslintConfig` usage detection.
+ *
+ * This module answers exactly one narrow question: which declared dependencies are referenced by a
+ * small, explicitly enumerated subset of the legacy ESLint configuration block stored inside
+ * `package.json`? The result is a set of configuration-only package names that is handed to the
+ * Step 56 analyzer seam, so a recognized name can only suppress an `unused` finding and can never
+ * create a `missing` one.
+ *
+ * It deliberately does not:
+ * - evaluate, `import()`, `require()` or otherwise run ESLint, a config loader or any target code;
+ * - implement the ESLint configuration schema. Only `extends` and `plugins` are read, and only
+ *   through the fixed allowlists below;
+ * - resolve `overrides`, scoped plugin shorthands, `plugin:<name>/<config>` forms other than the one
+ *   allowlisted string, shareable-config subpaths, or external `.eslintrc.*` files, which are read
+ *   by the sibling `findEslintRcJsonUsage` reader instead of duplicating these tables;
+ * - guess a package from arbitrary configuration text, substring-match a value, or invent a name;
+ * - report anything about a package the manifest does not declare;
+ * - mutate the analyzed project.
+ *
+ * The manifest model intentionally does not carry `eslintConfig`, so `package.json` is read a second
+ * time here as plain text: the loader is reused as the validity gate, and one extra small read beats
+ * widening the manifest model for one detector. Every unusable shape is ignored rather than
+ * diagnosed: manifest validity stays with the manifest loader and the analyzer, which report a
+ * genuinely invalid `package.json` as they always have.
+ *
+ * A conservative precedence guard applies before anything is read: when a hard barrier (a modern
+ * flat-config entrypoint, or a legacy `.eslintrc.js`/`.cjs`/`.yaml`/`.yml`) exists at the project
+ * root, the legacy block is not provably the active configuration, so no legacy hints are produced
+ * from either source. Presence is checked by directory entry name only; no entry is read,
+ * interpreted or executed. The precedence is computed once by {@link readLegacyEslintPrecedence},
+ * shared by both legacy readers, so the two sources obey exactly one set of rules.
+ */
+/**
+ * The legacy ESLint precedence state for one project root, computed once by both readers so the two
+ * legacy sources obey exactly one set of rules.
+ *
+ * - `hardBarrier`: a flat config or `.eslintrc.js`/`.cjs`/`.yaml`/`.yml` exists, which disables every
+ *   legacy hint from both sources;
+ * - `legacyRcByName`: a legacy `.eslintrc.json` or extensionless `.eslintrc` exists by name, which
+ *   displaces the manifest block but does not by itself stop the `.eslintrc.json` reader.
+ *
+ * Presence is checked by directory entry name only; no entry is opened, stat-followed, read or
+ * executed, and an unreadable root simply means no barrier is known to exist.
+ */
+export type LegacyEslintPrecedence = {
+    readonly hardBarrier: boolean;
+    readonly legacyRcByName: boolean;
+    readonly legacyRcJsonEntryName: string | undefined;
+};
+/**
+ * Compute the legacy ESLint precedence state for the project rooted at `projectRoot`.
+ *
+ * The two legacy readers ({@link findEslintManifestUsage} and {@link findEslintRcJsonUsage}) share
+ * this so a hard barrier disables both, `.eslintrc.json` wins over the manifest block, and an
+ * extensionless `.eslintrc` displaces only the manifest block. Neither reader unions the displaced
+ * source, so two contradictory legacy configurations are never combined.
+ *
+ * The legacy `.eslintrc.json` name is resolved case-insensitively, so the matched directory entry
+ * name is returned as `legacyRcJsonEntryName` for the JSON reader to reuse.
+ *
+ * @param projectRoot - Project directory to inspect; resolved to an absolute path.
+ */
+export declare function readLegacyEslintPrecedence(projectRoot: string): Promise<LegacyEslintPrecedence>;
+/**
+ * Match the allowlisted subset of one legacy `eslintConfig` value against the declared packages.
+ *
+ * Pure and side-effect free: it takes the raw `eslintConfig` JSON value (any shape, including
+ * something that is not an object) and the declared dependency names, and returns the declared
+ * packages that have configuration-only evidence, in alphabetical order. Neither argument is
+ * mutated, and a candidate that is not declared is dropped, so this function can never describe an
+ * undeclared package as used.
+ *
+ * @param eslintConfig - The raw `package.json#eslintConfig` value, validated here and never trusted.
+ * @param declaredPackageNames - Declared dependency names, the only names this may return.
+ */
+export declare function findEslintConfigUsage(eslintConfig: unknown, declaredPackageNames: ReadonlySet<string>): ReadonlySet<string>;
+/**
+ * Collect the legacy `package.json#eslintConfig` hints for the project rooted at `projectRoot`.
+ *
+ * The returned set is shaped for the analyzer's `configUsedNames` option (the Step 56 handoff),
+ * which is the only way configuration evidence reaches the analyzer. Nothing is decided here: the
+ * analyzer stays the sole owner of the unused/missing categories.
+ *
+ * No configuration problem is reported as an error. A missing manifest, an unreadable or invalid
+ * `package.json`, an unusable `eslintConfig` shape or an unreadable root all yield the empty set;
+ * the analyzer loads the manifest itself and remains the component that reports manifest failures,
+ * so this detector never replaces or duplicates that diagnosis.
+ *
+ * Legacy precedence (Step 68.1) is delegated to {@link readLegacyEslintPrecedence}, which both
+ * legacy readers share: a hard barrier disables this block outright, and any legacy `.eslintrc.*`
+ * by name displaces it in favour of the lower-priority `.eslintrc.json` reader. This reader never
+ * unions the displaced source, so the two legacy configurations are never combined.
+ *
+ * @param projectRoot - Project directory to inspect; resolved to an absolute path.
+ */
+export declare function findEslintManifestUsage(projectRoot: string): Promise<ReadonlySet<string>>;
+/**
+ * Whether the project rooted at `projectRoot` contains a modern flat-config entrypoint (see
+ * {@link FLAT_CONFIG_ENTRY_NAMES}).
+ *
+ * A flat config is a hard barrier: its presence disables every legacy hint, including the
+ * `package.json#eslintConfig` block, so it is checked before any legacy reader contributes a hint.
+ * This is a thin convenience for callers that only need the flat-config question. Only flat-config
+ * entrypoints count: a legacy `.eslintrc.*` file reports `false`, even though it still participates
+ * in the hard-barrier check inside the legacy readers.
+ *
+ * @param projectRoot - Project directory to inspect; resolved to an absolute path.
+ */
+export declare function hasFlatConfigEntry(projectRoot: string): Promise<boolean>;
+//# sourceMappingURL=eslintManifestConfig.d.ts.map

package/dist/detectors/eslintManifestConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eslintManifestConfig.d.ts","sourceRoot":"","sources":["../../src/detectors/eslintManifestConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AA4FH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC;CACpD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,sBAAsB,CAAC,CA8BjC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,OAAO,EACrB,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,GACxC,WAAW,CAAC,MAAM,CAAC,CAoBrB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAwB/F;AAaD;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS9E"}

package/dist/detectors/eslintManifestConfig.js

@@ -0,0 +1,348 @@
+/**
+ * Legacy `package.json#eslintConfig` usage detection.
+ *
+ * This module answers exactly one narrow question: which declared dependencies are referenced by a
+ * small, explicitly enumerated subset of the legacy ESLint configuration block stored inside
+ * `package.json`? The result is a set of configuration-only package names that is handed to the
+ * Step 56 analyzer seam, so a recognized name can only suppress an `unused` finding and can never
+ * create a `missing` one.
+ *
+ * It deliberately does not:
+ * - evaluate, `import()`, `require()` or otherwise run ESLint, a config loader or any target code;
+ * - implement the ESLint configuration schema. Only `extends` and `plugins` are read, and only
+ *   through the fixed allowlists below;
+ * - resolve `overrides`, scoped plugin shorthands, `plugin:<name>/<config>` forms other than the one
+ *   allowlisted string, shareable-config subpaths, or external `.eslintrc.*` files, which are read
+ *   by the sibling `findEslintRcJsonUsage` reader instead of duplicating these tables;
+ * - guess a package from arbitrary configuration text, substring-match a value, or invent a name;
+ * - report anything about a package the manifest does not declare;
+ * - mutate the analyzed project.
+ *
+ * The manifest model intentionally does not carry `eslintConfig`, so `package.json` is read a second
+ * time here as plain text: the loader is reused as the validity gate, and one extra small read beats
+ * widening the manifest model for one detector. Every unusable shape is ignored rather than
+ * diagnosed: manifest validity stays with the manifest loader and the analyzer, which report a
+ * genuinely invalid `package.json` as they always have.
+ *
+ * A conservative precedence guard applies before anything is read: when a hard barrier (a modern
+ * flat-config entrypoint, or a legacy `.eslintrc.js`/`.cjs`/`.yaml`/`.yml`) exists at the project
+ * root, the legacy block is not provably the active configuration, so no legacy hints are produced
+ * from either source. Presence is checked by directory entry name only; no entry is read,
+ * interpreted or executed. The precedence is computed once by {@link readLegacyEslintPrecedence},
+ * shared by both legacy readers, so the two sources obey exactly one set of rules.
+ */
+import { readFile, readdir } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { loadProjectManifest, ProjectManifestError } from '../scanner/projectManifest.js';
+/**
+ * The legacy `extends` values recognized by this release and the package each one refers to.
+ *
+ * The table is a fixed allowlist, not a resolution algorithm. It contains the three documented
+ * shorthand aliases (`prettier`, `airbnb` and the single `plugin:react/recommended` form) plus the
+ * already complete package name of each shareable config they point at, because a complete
+ * `eslint-config-*` name is a valid `extends` value in its own right.
+ *
+ * There is deliberately no plugin package name in this table. Legacy ESLint resolves `extends` as a
+ * shareable config name, so `extends: "eslint-plugin-react"` refers to a package named
+ * `eslint-config-eslint-plugin-react`, not to `eslint-plugin-react`; the only valid `extends` form
+ * for a plugin is `plugin:<name>/<config>`. A plugin is therefore credited through
+ * {@link PLUGIN_PACKAGE_NAMES} (or through an allowlisted `plugin:` form), never through a bare
+ * plugin name in `extends`, which would suppress a real `unused` finding based on a value ESLint
+ * cannot load.
+ *
+ * Anything else is unsupported on purpose: `eslint:recommended`, `eslint:all`,
+ * `plugin:other/recommended`, `prettier/react`, a scoped config, an unknown alias or any other
+ * string contributes no evidence, because a guessed alias would create false confidence.
+ */
+const EXTENDS_PACKAGE_NAMES = new Map([
+    ['prettier', 'eslint-config-prettier'],
+    ['airbnb', 'eslint-config-airbnb'],
+    ['plugin:react/recommended', 'eslint-plugin-react'],
+    ['eslint-config-prettier', 'eslint-config-prettier'],
+    ['eslint-config-airbnb', 'eslint-config-airbnb'],
+]);
+/**
+ * The legacy `plugins` entries recognized by this release and the package each one refers to.
+ *
+ * Same rule as {@link EXTENDS_PACKAGE_NAMES}: only the documented `react` shorthand and the already
+ * complete package name are supported. Invented plugin names, scoped shorthands such as
+ * `@acme/eslint-plugin` and any other plugin string produce no evidence.
+ *
+ * `plugins` is where the complete `eslint-plugin-react` name is valid, unlike in `extends` (see
+ * {@link EXTENDS_PACKAGE_NAMES}).
+ */
+const PLUGIN_PACKAGE_NAMES = new Map([
+    ['react', 'eslint-plugin-react'],
+    ['eslint-plugin-react', 'eslint-plugin-react'],
+]);
+/**
+ * Modern flat-config entrypoint names that form a hard barrier: their presence disables every legacy
+ * ESLint hint, from both `package.json#eslintConfig` and `.eslintrc.json`.
+ *
+ * Compared case-insensitively (see {@link readLegacyEslintPrecedence}) because case-insensitive
+ * filesystems treat `ESLint.Config.js` as the same file, so DepVitals must not disagree with itself
+ * about one project on different platforms. Added in Step 68.1: `mts`/`cts` join the original four.
+ */
+const FLAT_CONFIG_ENTRY_NAMES = new Set([
+    'eslint.config.js',
+    'eslint.config.mjs',
+    'eslint.config.cjs',
+    'eslint.config.ts',
+    'eslint.config.mts',
+    'eslint.config.cts',
+]);
+/**
+ * Legacy `.eslintrc.*` names that form a hard barrier for every legacy hint, same rule as the flat
+ * configs: `.eslintrc.js`, `.eslintrc.cjs`, `.eslintrc.yaml` and `.eslintrc.yml`.
+ *
+ * Legacy ESLint ignores `package.json#eslintConfig` once any `.eslintrc.*` file exists by name, so
+ * these names disable the manifest block too. Compared case-insensitively, like the flat configs.
+ */
+const LEGACY_BARRIER_ENTRY_NAMES = new Set([
+    '.eslintrc.js',
+    '.eslintrc.cjs',
+    '.eslintrc.yaml',
+    '.eslintrc.yml',
+]);
+/**
+ * Legacy `.eslintrc` names whose presence displaces the manifest block but does not by itself disable
+ * the `.eslintrc.json` reader: the extensionless `.eslintrc` and `.eslintrc.json` itself.
+ *
+ * Legacy ESLint ignores the manifest block once any `.eslintrc.*` file exists by name, so the
+ * extensionless `.eslintrc` displaces only the manifest block. `.eslintrc.json` is the file the JSON
+ * reader actually reads, so it is listed here as a pure name check for the manifest block. Compared
+ * case-insensitively, like the other legacy tables.
+ */
+const LEGACY_RC_BY_NAME_ENTRY_NAMES = new Set(['.eslintrc.json', '.eslintrc']);
+/**
+ * Compute the legacy ESLint precedence state for the project rooted at `projectRoot`.
+ *
+ * The two legacy readers ({@link findEslintManifestUsage} and {@link findEslintRcJsonUsage}) share
+ * this so a hard barrier disables both, `.eslintrc.json` wins over the manifest block, and an
+ * extensionless `.eslintrc` displaces only the manifest block. Neither reader unions the displaced
+ * source, so two contradictory legacy configurations are never combined.
+ *
+ * The legacy `.eslintrc.json` name is resolved case-insensitively, so the matched directory entry
+ * name is returned as `legacyRcJsonEntryName` for the JSON reader to reuse.
+ *
+ * @param projectRoot - Project directory to inspect; resolved to an absolute path.
+ */
+export async function readLegacyEslintPrecedence(projectRoot) {
+    const root = resolve(projectRoot);
+    let entries;
+    try {
+        entries = await readdir(root);
+    }
+    catch {
+        return {
+            hardBarrier: false,
+            legacyRcByName: false,
+            legacyRcJsonEntryName: undefined,
+        };
+    }
+    const has = (names) => entries.some((entry) => names.has(entry.toLowerCase()));
+    // The legacy `.eslintrc.json` name is matched case-insensitively (Windows/macOS resolve the
+    // same file under a different casing), so remember the actual entry that was found. The JSON
+    // reader reuses this exact entry name instead of assuming the canonical lowercase spelling.
+    // Prefer the canonical lowercase entry when both it and an uppercase copy exist in a
+    // case-sensitive root, so directory order cannot make the reader open the wrong file.
+    const legacyRcJsonEntryName = entries.includes('.eslintrc.json')
+        ? '.eslintrc.json'
+        : entries.find((entry) => entry.toLowerCase() === '.eslintrc.json');
+    return {
+        hardBarrier: has(FLAT_CONFIG_ENTRY_NAMES) || has(LEGACY_BARRIER_ENTRY_NAMES),
+        legacyRcByName: has(LEGACY_RC_BY_NAME_ENTRY_NAMES),
+        legacyRcJsonEntryName,
+    };
+}
+/**
+ * Match the allowlisted subset of one legacy `eslintConfig` value against the declared packages.
+ *
+ * Pure and side-effect free: it takes the raw `eslintConfig` JSON value (any shape, including
+ * something that is not an object) and the declared dependency names, and returns the declared
+ * packages that have configuration-only evidence, in alphabetical order. Neither argument is
+ * mutated, and a candidate that is not declared is dropped, so this function can never describe an
+ * undeclared package as used.
+ *
+ * @param eslintConfig - The raw `package.json#eslintConfig` value, validated here and never trusted.
+ * @param declaredPackageNames - Declared dependency names, the only names this may return.
+ */
+export function findEslintConfigUsage(eslintConfig, declaredPackageNames) {
+    if (!isPlainRecord(eslintConfig)) {
+        return new Set();
+    }
+    const candidates = [
+        ...matchTable(extendsValues(eslintConfig['extends']), EXTENDS_PACKAGE_NAMES),
+        ...matchTable(pluginsValues(eslintConfig['plugins']), PLUGIN_PACKAGE_NAMES),
+    ];
+    const used = new Set();
+    for (const candidate of candidates) {
+        if (declaredPackageNames.has(candidate)) {
+            used.add(candidate);
+        }
+    }
+    // Rebuilt from sorted names so iteration is deterministic for every input.
+    return new Set([...used].sort(compareNames));
+}
+/**
+ * Collect the legacy `package.json#eslintConfig` hints for the project rooted at `projectRoot`.
+ *
+ * The returned set is shaped for the analyzer's `configUsedNames` option (the Step 56 handoff),
+ * which is the only way configuration evidence reaches the analyzer. Nothing is decided here: the
+ * analyzer stays the sole owner of the unused/missing categories.
+ *
+ * No configuration problem is reported as an error. A missing manifest, an unreadable or invalid
+ * `package.json`, an unusable `eslintConfig` shape or an unreadable root all yield the empty set;
+ * the analyzer loads the manifest itself and remains the component that reports manifest failures,
+ * so this detector never replaces or duplicates that diagnosis.
+ *
+ * Legacy precedence (Step 68.1) is delegated to {@link readLegacyEslintPrecedence}, which both
+ * legacy readers share: a hard barrier disables this block outright, and any legacy `.eslintrc.*`
+ * by name displaces it in favour of the lower-priority `.eslintrc.json` reader. This reader never
+ * unions the displaced source, so the two legacy configurations are never combined.
+ *
+ * @param projectRoot - Project directory to inspect; resolved to an absolute path.
+ */
+export async function findEslintManifestUsage(projectRoot) {
+    const root = resolve(projectRoot);
+    const precedence = await readLegacyEslintPrecedence(root);
+    if (precedence.hardBarrier || precedence.legacyRcByName) {
+        return new Set();
+    }
+    let packageJsonPath;
+    let declaredPackageNames;
+    try {
+        const manifest = await loadProjectManifest(root);
+        packageJsonPath = manifest.packageJsonPath;
+        declaredPackageNames = manifest.declaredDependencyNames;
+    }
+    catch (error) {
+        if (error instanceof ProjectManifestError) {
+            return new Set();
+        }
+        throw error;
+    }
+    return findEslintConfigUsage(await readEslintConfigValue(packageJsonPath), declaredPackageNames);
+}
+/**
+ * Whether the on-disk directory entries contain a modern flat-config entrypoint (see
+ * {@link FLAT_CONFIG_ENTRY_NAMES}).
+ *
+ * A legacy `.eslintrc.*` file is not a flat-config entrypoint, so this predicate checks only the
+ * flat-config names.
+ */
+function hasFlatConfigEntryEntries(entries) {
+    return entries.some((entry) => FLAT_CONFIG_ENTRY_NAMES.has(entry.toLowerCase()));
+}
+/**
+ * Whether the project rooted at `projectRoot` contains a modern flat-config entrypoint (see
+ * {@link FLAT_CONFIG_ENTRY_NAMES}).
+ *
+ * A flat config is a hard barrier: its presence disables every legacy hint, including the
+ * `package.json#eslintConfig` block, so it is checked before any legacy reader contributes a hint.
+ * This is a thin convenience for callers that only need the flat-config question. Only flat-config
+ * entrypoints count: a legacy `.eslintrc.*` file reports `false`, even though it still participates
+ * in the hard-barrier check inside the legacy readers.
+ *
+ * @param projectRoot - Project directory to inspect; resolved to an absolute path.
+ */
+export async function hasFlatConfigEntry(projectRoot) {
+    let entries;
+    try {
+        entries = await readdir(resolve(projectRoot));
+    }
+    catch {
+        return false;
+    }
+    return hasFlatConfigEntryEntries(entries);
+}
+/**
+ * Read the raw `package.json#eslintConfig` value, ignoring everything that cannot be used.
+ *
+ * The manifest is read as text and parsed with `JSON.parse`, so no target-project code runs. An
+ * unreadable file, invalid JSON, a non-object document or an absent `eslintConfig` all yield
+ * `undefined`; the loader-facing diagnosis of a broken manifest stays in {@link loadProjectManifest}.
+ */
+async function readEslintConfigValue(packageJsonPath) {
+    let text;
+    try {
+        text = await readFile(packageJsonPath, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    return isPlainRecord(parsed) ? parsed['eslintConfig'] : undefined;
+}
+/**
+ * The string values of `extends`, which ESLint accepts as one string or as an array.
+ *
+ * Non-string array entries contribute nothing on their own, so a malformed array still yields no
+ * evidence for the malformed entries. Any other shape (number, object, `null`, ...) contributes
+ * nothing at all.
+ */
+function extendsValues(value) {
+    if (typeof value === 'string') {
+        return [value];
+    }
+    return stringItems(value);
+}
+/**
+ * The string values of `plugins`, which ESLint accepts only as an array.
+ *
+ * A bare string such as `"react"` is not a valid `plugins` value and is deliberately not accepted,
+ * so a typo-shaped value never becomes evidence.
+ */
+function pluginsValues(value) {
+    return stringItems(value);
+}
+/**
+ * The string entries of an array value; a non-array value contributes nothing.
+ */
+function stringItems(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.filter((entry) => typeof entry === 'string');
+}
+/**
+ * Look every value up in one fixed allowlist table.
+ *
+ * Lookup is exact-string only: no prefix, suffix, substring or case-insensitive matching, so
+ * `prettier/react`, `eslint-config-unknown` and `React` never match an entry.
+ */
+function matchTable(values, table) {
+    const matched = [];
+    for (const value of values) {
+        const mapped = table.get(value);
+        if (mapped !== undefined) {
+            matched.push(mapped);
+        }
+    }
+    return matched;
+}
+/**
+ * A JSON object (not an array, not `null`) whose keys are strings.
+ */
+function isPlainRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Locale-independent lexicographic ordering, so the same configuration always yields the same order.
+ */
+function compareNames(a, b) {
+    if (a < b) {
+        return -1;
+    }
+    if (a > b) {
+        return 1;
+    }
+    return 0;
+}
+//# sourceMappingURL=eslintManifestConfig.js.map

package/dist/detectors/eslintManifestConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eslintManifestConfig.js","sourceRoot":"","sources":["../../src/detectors/eslintManifestConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,qBAAqB,GAAgC,IAAI,GAAG,CAAC;IACjE,CAAC,UAAU,EAAE,wBAAwB,CAAC;IACtC,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAClC,CAAC,0BAA0B,EAAE,qBAAqB,CAAC;IACnD,CAAC,wBAAwB,EAAE,wBAAwB,CAAC;IACpD,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;CACjD,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAgC,IAAI,GAAG,CAAC;IAChE,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAChC,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;CAC/C,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,kBAAkB;IAClB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,mBAAmB;IACnB,mBAAmB;CACpB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC;IAC9D,cAAc;IACd,eAAe;IACf,gBAAgB;IAChB,eAAe;CAChB,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC;AAoBpG;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAElC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,KAAK;YACrB,qBAAqB,EAAE,SAAS;SACjC,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,KAA0B,EAAW,EAAE,CAClD,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1D,4FAA4F;IAC5F,6FAA6F;IAC7F,4FAA4F;IAC5F,qFAAqF;IACrF,sFAAsF;IACtF,MAAM,qBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC9D,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,CAAC;IAEtE,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,uBAAuB,CAAC,IAAI,GAAG,CAAC,0BAA0B,CAAC;QAC5E,cAAc,EAAE,GAAG,CAAC,6BAA6B,CAAC;QAClD,qBAAqB;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAAqB,EACrB,oBAAyC;IAEzC,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,GAAG,EAAU,CAAC;IAC3B,CAAC;IAED,MAAM,UAAU,GAAa;QAC3B,GAAG,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,qBAAqB,CAAC;QAC5E,GAAG,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,oBAAoB,CAAC;KAC5E,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,OAAO,IAAI,GAAG,CAAS,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,WAAmB;IAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAElC,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;QACxD,OAAO,IAAI,GAAG,EAAU,CAAC;IAC3B,CAAC;IAED,IAAI,eAAuB,CAAC;IAC5B,IAAI,oBAAyC,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACjD,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;QAC3C,oBAAoB,GAAG,QAAQ,CAAC,uBAAuB,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;YAC1C,OAAO,IAAI,GAAG,EAAU,CAAC;QAC3B,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO,qBAAqB,CAAC,MAAM,qBAAqB,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,OAA0B;IAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAmB;IAC1D,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,qBAAqB,CAAC,eAAuB;IAC1D,IAAI,IAAY,CAAC;IAEjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CACjB,MAAyB,EACzB,KAAkC;IAElC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEhC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/detectors/eslintRcJsonConfig.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Legacy external `.eslintrc.json` usage detection.
+ *
+ * This module adds exactly one static data source to the ESLint rules proven in Step 57: the single
+ * file `<projectRoot>/.eslintrc.json`. Its parsed JSON document is handed to the same pure matcher
+ * ({@link findEslintConfigUsage}) that reads `package.json#eslintConfig`, so the fixed allowlists,
+ * the exact-string lookup and the "declared packages only" rule are reused instead of duplicated.
+ * The result is a set of configuration-only package names for the Step 56 analyzer seam, so a
+ * recognized name can only suppress an `unused` finding and can never create a `missing` one.
+ *
+ * It deliberately does not:
+ * - evaluate, `import()`, `require()` or otherwise run ESLint, a config loader or any target code.
+ *   The file is read as UTF-8 text and parsed with `JSON.parse`;
+ * - support any other legacy format: `.eslintrc.js` / `.cjs` / `.mjs` (JavaScript config modules),
+ *   `.eslintrc.yml` / `.yaml` and extensionless `.eslintrc` are explicitly dismissed in this
+ *   release, as is JSON5 or comment-tolerant JSON. A `.eslintrc.json` that uses JavaScript-style
+ *   comments is therefore reported as the operational error described below rather than parsed by a
+ *   second JSON dialect: DepVitals reads one strict JSON document, and a hand-written comment
+ *   stripper that mis-handled a `//` inside a string value could alter the document and invent
+ *   evidence. A leading UTF-8 BOM is different - it is an encoding artifact of the very same
+ *   document, so it is removed before parsing;
+ * - traverse parent directories, nested packages or workspaces looking for further config files, or
+ *   resolve `extends` references to other configuration files;
+ * - read anything besides the `extends`/`plugins` subset that {@link findEslintConfigUsage} accepts;
+ *   every other ESLint field (`env`, `globals`, `rules`, `parserOptions`, `overrides`, ...) is
+ *   ignored, and no unknown value produces evidence;
+ * - report anything about a package the manifest does not declare, or mutate the analyzed project.
+ *
+ * Two conservative file rules keep the reader honest:
+ *
+ * - only a regular file at exactly `<projectRoot>/.eslintrc.json` is read. The path is built from a
+ *   fixed file name joined to the resolved root, so it cannot point outside the project, and
+ *   `lstat` (not `stat`) is used so a symlinked `.eslintrc.json` is skipped rather than followed.
+ *   Following a link could read content that lives outside the analyzed tree, which the scan policy
+ *   forbids; skipping is the safe answer and is a documented limitation;
+ * - a file that exists and is a regular file but cannot be read or parsed is reported as an
+ *   operational {@link EslintRcJsonError}. Silently ignoring it would drop the only evidence for a
+ *   package that the broken configuration may well reference, and would let the scan present a
+ *   misleadingly clean or wrongly `unused` result. Valid JSON with an unusable top-level shape
+ *   (array, string, number, `null`) is different: it is not an ESLint configuration at all, so it
+ *   contributes no evidence and is never an error, exactly like the unknown-field case.
+ *
+ * Precedence follows the legacy ESLint rule that one active configuration wins: a hard barrier (a
+ * modern flat config or `.eslintrc.js`/`.cjs`/`.yaml`/`.yml`) disables every legacy hint, and
+ * otherwise this file wins over `package.json#eslintConfig`. The precedence is computed once by a
+ * helper both legacy readers share; the barrier is presence-based and never reads the displaced
+ * source for evidence, so two contradictory legacy sources are never unioned.
+ */
+/**
+ * Why a present `.eslintrc.json` could not be used as a configuration data source.
+ *
+ * - `unreadable`: the entry is a regular file but could not be read (permissions, I/O failure, ...).
+ * - `invalid-json`: the file content is not valid JSON, so the configuration it intends to declare
+ *   is unknowable rather than empty.
+ *
+ * A missing file, a non-regular entry (directory, FIFO, socket, symlink) and valid JSON with an
+ * unusable top-level shape are not errors: they simply produce no evidence.
+ */
+export type EslintRcJsonErrorCode = 'unreadable' | 'invalid-json';
+/**
+ * Operational error for an unusable `.eslintrc.json`.
+ *
+ * The `code` lets callers render a clean message without matching on error strings, following the
+ * existing `ProjectManifestError` / `SourceFilesError` convention. Throwing is deliberate: an
+ * unreadable or unparsable configuration that DepVitals silently skipped could otherwise turn into
+ * an unfounded `unused` finding.
+ */
+export declare class EslintRcJsonError extends Error {
+    readonly code: EslintRcJsonErrorCode;
+    constructor(message: string, code: EslintRcJsonErrorCode, cause?: unknown);
+}
+/**
+ * Collect the external `.eslintrc.json` hints for the project rooted at `projectRoot`.
+ *
+ * The returned set is shaped for the analyzer's `configUsedNames` option (the Step 56 handoff),
+ * which is the only way configuration evidence reaches the analyzer. Nothing is decided here: the
+ * analyzer stays the sole owner of the unused/missing categories, and an undeclared package can
+ * never appear in the result.
+ *
+ * @param projectRoot - Project directory to inspect; resolved to an absolute path.
+ * @throws {EslintRcJsonError} when a regular `.eslintrc.json` file exists but cannot be read or
+ * parsed as JSON. Absent, skipped and unusable-but-parsable files return the empty set.
+ */
+export declare function findEslintRcJsonUsage(projectRoot: string): Promise<ReadonlySet<string>>;
+//# sourceMappingURL=eslintRcJsonConfig.d.ts.map

package/dist/detectors/eslintRcJsonConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eslintRcJsonConfig.d.ts","sourceRoot":"","sources":["../../src/detectors/eslintRcJsonConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAgBH;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAAG,YAAY,GAAG,cAAc,CAAC;AAElE;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;gBAEzB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,CAAC,EAAE,OAAO;CAK1E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAsD7F"}