depvitals 0.1.1 → 0.2.0

package/dist/detectors/eslintRcJsonConfig.js

@@ -0,0 +1,188 @@
+/**
+ * Legacy external `.eslintrc.json` usage detection.
+ *
+ * This module adds exactly one static data source to the ESLint rules proven in Step 57: the single
+ * file `<projectRoot>/.eslintrc.json`. Its parsed JSON document is handed to the same pure matcher
+ * ({@link findEslintConfigUsage}) that reads `package.json#eslintConfig`, so the fixed allowlists,
+ * the exact-string lookup and the "declared packages only" rule are reused instead of duplicated.
+ * The result is a set of configuration-only package names for the Step 56 analyzer seam, so a
+ * recognized name can only suppress an `unused` finding and can never create a `missing` one.
+ *
+ * It deliberately does not:
+ * - evaluate, `import()`, `require()` or otherwise run ESLint, a config loader or any target code.
+ *   The file is read as UTF-8 text and parsed with `JSON.parse`;
+ * - support any other legacy format: `.eslintrc.js` / `.cjs` / `.mjs` (JavaScript config modules),
+ *   `.eslintrc.yml` / `.yaml` and extensionless `.eslintrc` are explicitly dismissed in this
+ *   release, as is JSON5 or comment-tolerant JSON. A `.eslintrc.json` that uses JavaScript-style
+ *   comments is therefore reported as the operational error described below rather than parsed by a
+ *   second JSON dialect: DepVitals reads one strict JSON document, and a hand-written comment
+ *   stripper that mis-handled a `//` inside a string value could alter the document and invent
+ *   evidence. A leading UTF-8 BOM is different - it is an encoding artifact of the very same
+ *   document, so it is removed before parsing;
+ * - traverse parent directories, nested packages or workspaces looking for further config files, or
+ *   resolve `extends` references to other configuration files;
+ * - read anything besides the `extends`/`plugins` subset that {@link findEslintConfigUsage} accepts;
+ *   every other ESLint field (`env`, `globals`, `rules`, `parserOptions`, `overrides`, ...) is
+ *   ignored, and no unknown value produces evidence;
+ * - report anything about a package the manifest does not declare, or mutate the analyzed project.
+ *
+ * Two conservative file rules keep the reader honest:
+ *
+ * - only a regular file at exactly `<projectRoot>/.eslintrc.json` is read. The path is built from a
+ *   fixed file name joined to the resolved root, so it cannot point outside the project, and
+ *   `lstat` (not `stat`) is used so a symlinked `.eslintrc.json` is skipped rather than followed.
+ *   Following a link could read content that lives outside the analyzed tree, which the scan policy
+ *   forbids; skipping is the safe answer and is a documented limitation;
+ * - a file that exists and is a regular file but cannot be read or parsed is reported as an
+ *   operational {@link EslintRcJsonError}. Silently ignoring it would drop the only evidence for a
+ *   package that the broken configuration may well reference, and would let the scan present a
+ *   misleadingly clean or wrongly `unused` result. Valid JSON with an unusable top-level shape
+ *   (array, string, number, `null`) is different: it is not an ESLint configuration at all, so it
+ *   contributes no evidence and is never an error, exactly like the unknown-field case.
+ *
+ * Precedence follows the legacy ESLint rule that one active configuration wins: a hard barrier (a
+ * modern flat config or `.eslintrc.js`/`.cjs`/`.yaml`/`.yml`) disables every legacy hint, and
+ * otherwise this file wins over `package.json#eslintConfig`. The precedence is computed once by a
+ * helper both legacy readers share; the barrier is presence-based and never reads the displaced
+ * source for evidence, so two contradictory legacy sources are never unioned.
+ */
+import { lstat, readFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { loadProjectManifest, ProjectManifestError } from '../scanner/projectManifest.js';
+import { findEslintConfigUsage, readLegacyEslintPrecedence } from './eslintManifestConfig.js';
+/**
+ * The one file name this reader looks for, relative to the resolved project root.
+ *
+ * There is intentionally no list of alternative legacy names: `.eslintrc.yml`, `.eslintrc.js` and
+ * the extensionless `.eslintrc` are out of scope for this release, so no reader is added for them.
+ */
+const ESLINTRC_FILENAME = '.eslintrc.json';
+/**
+ * Operational error for an unusable `.eslintrc.json`.
+ *
+ * The `code` lets callers render a clean message without matching on error strings, following the
+ * existing `ProjectManifestError` / `SourceFilesError` convention. Throwing is deliberate: an
+ * unreadable or unparsable configuration that DepVitals silently skipped could otherwise turn into
+ * an unfounded `unused` finding.
+ */
+export class EslintRcJsonError extends Error {
+    code;
+    constructor(message, code, cause) {
+        super(message, cause === undefined ? undefined : { cause });
+        this.name = 'EslintRcJsonError';
+        this.code = code;
+    }
+}
+/**
+ * Collect the external `.eslintrc.json` hints for the project rooted at `projectRoot`.
+ *
+ * The returned set is shaped for the analyzer's `configUsedNames` option (the Step 56 handoff),
+ * which is the only way configuration evidence reaches the analyzer. Nothing is decided here: the
+ * analyzer stays the sole owner of the unused/missing categories, and an undeclared package can
+ * never appear in the result.
+ *
+ * @param projectRoot - Project directory to inspect; resolved to an absolute path.
+ * @throws {EslintRcJsonError} when a regular `.eslintrc.json` file exists but cannot be read or
+ * parsed as JSON. Absent, skipped and unusable-but-parsable files return the empty set.
+ */
+export async function findEslintRcJsonUsage(projectRoot) {
+    const root = resolve(projectRoot);
+    // A hard barrier disables every legacy hint, external file included. Precedence is computed once
+    // by a helper both legacy readers share, so this file always wins over `package.json#eslintConfig`
+    // and the two legacy sources are never combined into one hint set.
+    const precedence = await readLegacyEslintPrecedence(root);
+    if (precedence.hardBarrier) {
+        return new Set();
+    }
+    let declaredPackageNames;
+    try {
+        const manifest = await loadProjectManifest(root);
+        declaredPackageNames = manifest.declaredDependencyNames;
+    }
+    catch (error) {
+        if (error instanceof ProjectManifestError) {
+            // Manifest failures stay with the manifest loader and the analyzer, which report them as they
+            // always have; this detector never duplicates that diagnosis.
+            return new Set();
+        }
+        throw error;
+    }
+    // Reuse the on-disk entry name when the legacy `.eslintrc.json` was found under a different
+    // casing, so the reader opens the file that actually exists instead of assuming the canonical
+    // lowercase spelling.
+    const eslintRcFilename = precedence.legacyRcJsonEntryName ?? ESLINTRC_FILENAME;
+    const eslintRcPath = join(root, eslintRcFilename);
+    const text = await readEslintRcText(eslintRcPath);
+    if (text === undefined) {
+        return new Set();
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(withoutByteOrderMark(text));
+    }
+    catch (error) {
+        throw new EslintRcJsonError(`${eslintRcFilename} at ${eslintRcPath} is not valid JSON. DepVitals reads strict JSON ` +
+            `only, so JavaScript-style comments inside ${eslintRcFilename} are not supported.`, 'invalid-json', error);
+    }
+    // The whole document is the legacy config object, so the proven matcher is reused verbatim. A
+    // top-level value that is not an object simply matches nothing, and nothing undeclared is added.
+    return findEslintConfigUsage(parsed, declaredPackageNames);
+}
+/**
+ * Read `.eslintrc.json` as text, returning `undefined` when there is no usable file.
+ *
+ * `undefined` means "no external configuration to consult": the file is absent, or it is not a
+ * regular file. Anything else that prevents reading a real configuration file is an explicit error,
+ * because guessing that a broken file declares nothing is how a false `unused` finding starts.
+ */
+async function readEslintRcText(eslintRcPath) {
+    let stats;
+    try {
+        // `lstat`, not `stat`: a symlinked `.eslintrc.json` is not followed, so content outside the
+        // analyzed project tree is never read. The path is `<root>/.eslintrc.json` built from a fixed
+        // file name, so it cannot address anything outside the resolved root by construction.
+        stats = await lstat(eslintRcPath);
+    }
+    catch (error) {
+        if (isNotFoundError(error)) {
+            return undefined;
+        }
+        throw toUnreadableError(eslintRcPath, error);
+    }
+    // Only a regular file is read: a directory, FIFO, socket or symlink contributes no evidence.
+    if (!stats.isFile()) {
+        return undefined;
+    }
+    try {
+        return await readFile(eslintRcPath, 'utf8');
+    }
+    catch (error) {
+        if (isNotFoundError(error)) {
+            // The file disappeared between the two calls: that is an absent configuration, not a broken one.
+            return undefined;
+        }
+        throw toUnreadableError(eslintRcPath, error);
+    }
+}
+/**
+ * Remove a leading UTF-8 BOM, which `readFile(..., 'utf8')` keeps verbatim.
+ *
+ * A BOM is an encoding artifact of the same JSON document rather than a different configuration
+ * format, so it must not turn a readable configuration into an `invalid-json` failure.
+ */
+function withoutByteOrderMark(text) {
+    return text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+}
+/**
+ * Wrap a filesystem failure on a real `.eslintrc.json` file as an operational error.
+ */
+function toUnreadableError(eslintRcPath, error) {
+    return new EslintRcJsonError(`Could not read ${ESLINTRC_FILENAME} at ${eslintRcPath}`, 'unreadable', error);
+}
+/**
+ * Whether an unknown thrown value is the filesystem `ENOENT` error.
+ */
+function isNotFoundError(error) {
+    return error instanceof Error && 'code' in error && error.code === 'ENOENT';
+}
+//# sourceMappingURL=eslintRcJsonConfig.js.map

package/dist/detectors/eslintRcJsonConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eslintRcJsonConfig.js","sourceRoot":"","sources":["../../src/detectors/eslintRcJsonConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAE9F;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAc3C;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAwB;IAErC,YAAY,OAAe,EAAE,IAA2B,EAAE,KAAe;QACvE,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,WAAmB;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAElC,iGAAiG;IACjG,mGAAmG;IACnG,mEAAmE;IACnE,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC3B,OAAO,IAAI,GAAG,EAAU,CAAC;IAC3B,CAAC;IAED,IAAI,oBAAyC,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAEjD,oBAAoB,GAAG,QAAQ,CAAC,uBAAuB,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;YAC1C,8FAA8F;YAC9F,8DAA8D;YAC9D,OAAO,IAAI,GAAG,EAAU,CAAC;QAC3B,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;IAED,4FAA4F;IAC5F,8FAA8F;IAC9F,sBAAsB;IACtB,MAAM,gBAAgB,GAAG,UAAU,CAAC,qBAAqB,IAAI,iBAAiB,CAAC;IAC/E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAElD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,GAAG,EAAU,CAAC;IAC3B,CAAC;IAED,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,GAAG,gBAAgB,OAAO,YAAY,kDAAkD;YACtF,6CAA6C,gBAAgB,qBAAqB,EACpF,cAAc,EACd,KAAK,CACN,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,iGAAiG;IACjG,OAAO,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAAC,YAAoB;IAClD,IAAI,KAAK,CAAC;IAEV,IAAI,CAAC;QACH,4FAA4F;QAC5F,8FAA8F;QAC9F,sFAAsF;QACtF,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,6FAA6F;IAC7F,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,iGAAiG;YACjG,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,YAAoB,EAAE,KAAc;IAC7D,OAAO,IAAI,iBAAiB,CAC1B,kBAAkB,iBAAiB,OAAO,YAAY,EAAE,EACxD,YAAY,EACZ,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC"}

package/dist/detectors/jestManifestConfig.d.ts

@@ -0,0 +1,76 @@
+/**
+ * `package.json#jest` usage detection.
+ *
+ * This module answers exactly one narrow question: which declared dependencies are named by the three
+ * explicit Jest fields this release understands inside the `jest` block of `package.json` — the
+ * top-level `preset` and `testEnvironment` strings and the values of the top-level `transform` map?
+ * The result is a set of configuration-only package names handed to the Step 56 analyzer seam, so a
+ * recognized name can only suppress an `unused` finding and can never create a `missing` one.
+ *
+ * It deliberately does not:
+ * - execute Jest, `import()`/`require()` its configuration loader, or evaluate any target code;
+ * - implement the Jest configuration schema. Only `preset`, `testEnvironment` and `transform` are
+ *   read, and only through the fixed allowlists below;
+ * - read the `transform` map *keys*. Every key of that map is a regular expression selecting the
+ *   files a transformer applies to, so a key is a pattern and never a package name, even when it
+ *   literally reads `"ts-jest"`; no regular expression is ever evaluated here;
+ * - expand Jest shorthands. In particular `testEnvironment: "jsdom"` is *not* credited to
+ *   `jest-environment-jsdom`: whether that shorthand is a package reference at all depends on the
+ *   Jest major version in use, which DepVitals does not read, so it stays outside the supported
+ *   subset of explicit package names;
+ * - interpret `<rootDir>/...`, `./...`, absolute paths, URLs or any other resolver-looking string as a
+ *   package reference;
+ * - read `jest.config.js`/`.cjs`/`.mjs`/`.ts`/`.json` contents. Those files are only checked for
+ *   presence, never opened here (source detection already handles their imports on its own);
+ * - guess a package from arbitrary configuration text, substring-match a value, or invent a name;
+ * - report anything about a package the manifest does not declare;
+ * - mutate the analyzed project.
+ *
+ * A conservative precedence guard applies before anything is read: when a root `jest.config.*` file
+ * exists, it is not provable which configuration Jest actually loads, so no `package.json#jest`
+ * hints are produced. Presence is checked by directory entry name only.
+ *
+ * The manifest model intentionally does not carry `jest`, so `package.json` is read a second time here
+ * as plain text (same trade-off as the legacy ESLint readers): the loader stays the validity gate and
+ * the single reporter of a broken manifest, while this detector silently ignores every shape it cannot
+ * use. Ignoring is deliberate — an unusable `jest` block is not an error, and diagnosing one here would
+ * duplicate the manifest loader.
+ */
+/**
+ * Match the allowlisted subset of one `jest` configuration against the declared packages.
+ *
+ * Pure and side-effect free: it takes the raw `package.json#jest` JSON value (any shape, including
+ * something that is not an object) and the declared dependency names, and returns the declared
+ * packages named by `preset`, `testEnvironment` or the values of `transform`, in alphabetical order.
+ * Neither argument is mutated, and a candidate that is not declared is dropped, so this function can
+ * never describe an undeclared package as used.
+ *
+ * @param jestConfig - The raw `package.json#jest` value, validated here and never trusted.
+ * @param declaredPackageNames - Declared dependency names, the only names this may return.
+ */
+export declare function findJestConfigUsage(jestConfig: unknown, declaredPackageNames: ReadonlySet<string>): ReadonlySet<string>;
+/**
+ * Collect the `package.json#jest` hints for the project rooted at `projectRoot`.
+ *
+ * The returned set is shaped for the analyzer's `configUsedNames` option (the Step 56 handoff), which
+ * is the only way configuration evidence reaches the analyzer. Nothing is decided here: the analyzer
+ * stays the sole owner of the unused/missing categories.
+ *
+ * No configuration problem is reported as an error. A missing manifest, an unreadable or invalid
+ * `package.json`, an unusable `jest` shape or an unreadable root all yield the empty set; the analyzer
+ * loads the manifest itself and remains the component that reports manifest failures, so this detector
+ * never replaces or duplicates that diagnosis.
+ *
+ * @param projectRoot - Project directory to inspect; resolved to an absolute path.
+ */
+export declare function findJestManifestUsage(projectRoot: string): Promise<ReadonlySet<string>>;
+/**
+ * Whether a root Jest configuration file name exists in the project root.
+ *
+ * The root directory is listed by name only (`readdir`), so no entry is opened, stat-followed, read or
+ * executed. An unreadable or missing root simply means no root Jest config is known to be present.
+ * Names are compared case-insensitively so a case-insensitive filesystem (typical on Windows and
+ * macOS) cannot hide a root Jest config from this guard.
+ */
+export declare function hasRootJestConfigEntry(root: string): Promise<boolean>;
+//# sourceMappingURL=jestManifestConfig.d.ts.map

package/dist/detectors/jestManifestConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jestManifestConfig.d.ts","sourceRoot":"","sources":["../../src/detectors/jestManifestConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAmEH;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,OAAO,EACnB,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,GACxC,WAAW,CAAC,MAAM,CAAC,CAqBrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAuB7F;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU3E"}

package/dist/detectors/jestManifestConfig.js

@@ -0,0 +1,292 @@
+/**
+ * `package.json#jest` usage detection.
+ *
+ * This module answers exactly one narrow question: which declared dependencies are named by the three
+ * explicit Jest fields this release understands inside the `jest` block of `package.json` — the
+ * top-level `preset` and `testEnvironment` strings and the values of the top-level `transform` map?
+ * The result is a set of configuration-only package names handed to the Step 56 analyzer seam, so a
+ * recognized name can only suppress an `unused` finding and can never create a `missing` one.
+ *
+ * It deliberately does not:
+ * - execute Jest, `import()`/`require()` its configuration loader, or evaluate any target code;
+ * - implement the Jest configuration schema. Only `preset`, `testEnvironment` and `transform` are
+ *   read, and only through the fixed allowlists below;
+ * - read the `transform` map *keys*. Every key of that map is a regular expression selecting the
+ *   files a transformer applies to, so a key is a pattern and never a package name, even when it
+ *   literally reads `"ts-jest"`; no regular expression is ever evaluated here;
+ * - expand Jest shorthands. In particular `testEnvironment: "jsdom"` is *not* credited to
+ *   `jest-environment-jsdom`: whether that shorthand is a package reference at all depends on the
+ *   Jest major version in use, which DepVitals does not read, so it stays outside the supported
+ *   subset of explicit package names;
+ * - interpret `<rootDir>/...`, `./...`, absolute paths, URLs or any other resolver-looking string as a
+ *   package reference;
+ * - read `jest.config.js`/`.cjs`/`.mjs`/`.ts`/`.json` contents. Those files are only checked for
+ *   presence, never opened here (source detection already handles their imports on its own);
+ * - guess a package from arbitrary configuration text, substring-match a value, or invent a name;
+ * - report anything about a package the manifest does not declare;
+ * - mutate the analyzed project.
+ *
+ * A conservative precedence guard applies before anything is read: when a root `jest.config.*` file
+ * exists, it is not provable which configuration Jest actually loads, so no `package.json#jest`
+ * hints are produced. Presence is checked by directory entry name only.
+ *
+ * The manifest model intentionally does not carry `jest`, so `package.json` is read a second time here
+ * as plain text (same trade-off as the legacy ESLint readers): the loader stays the validity gate and
+ * the single reporter of a broken manifest, while this detector silently ignores every shape it cannot
+ * use. Ignoring is deliberate — an unusable `jest` block is not an error, and diagnosing one here would
+ * duplicate the manifest loader.
+ */
+import { readFile, readdir } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { loadProjectManifest, ProjectManifestError } from '../scanner/projectManifest.js';
+import { classifyPackageSpecifier } from '../scanner/packageSpecifier.js';
+/**
+ * The only `preset` packages recognized by this release.
+ *
+ * A fixed allowlist, not a resolution algorithm: `ts-jest` is supported because it is the published
+ * package name of the preset itself, so the string is already a complete package reference and needs
+ * no Jest-version knowledge to interpret. Any other preset name is unsupported and contributes no
+ * evidence, since guessing what an unknown preset string resolves to would create false confidence.
+ *
+ * A literal subpath of an allowlisted package (`"ts-jest/presets/default-esm"`) is accepted too,
+ * through the existing package-root normalization in {@link classifyPackageSpecifier}: the first path
+ * segment of such a specifier is the package that provides the preset.
+ */
+const PRESET_PACKAGE_NAMES = new Set(['ts-jest']);
+/**
+ * The only `testEnvironment` packages recognized by this release.
+ *
+ * Again the complete package name only; the `"jsdom"` shorthand is deliberately absent from this
+ * release. Where Jest accepts `"jsdom"`, it does resolve it to the separately installed
+ * `jest-environment-jsdom` package - but whether that shorthand is available at all depends on the
+ * Jest major version (up to v27 the jsdom environment shipped inside Jest itself, so such a project
+ * declares no package to credit), and DepVitals neither reads nor resolves the Jest version of an
+ * analyzed project. The supported subset is therefore fixed to the exact package name; shorthand
+ * resolution is a separate change that must first define which Jest versions it applies to.
+ */
+const TEST_ENVIRONMENT_PACKAGE_NAMES = new Set(['jest-environment-jsdom']);
+/**
+ * The only `transform` packages recognized by this release.
+ *
+ * A separate fixed allowlist rather than a reuse of the `preset` one: `ts-jest` is the only
+ * transformer credited, and it is supported for the same reason as the preset — the string is already
+ * the complete published package name, so nothing has to be resolved or versioned to interpret it.
+ * `jest-environment-jsdom` is deliberately absent, because a test environment is not a transformer;
+ * no other transform module is resolved, guessed, searched for in `node_modules` or matched by
+ * prefix, and transform maps are never flattened or searched recursively.
+ */
+const TRANSFORM_PACKAGE_NAMES = new Set(['ts-jest']);
+/**
+ * Root Jest configuration file names that disable `package.json#jest` hints.
+ *
+ * The list is fixed to the extensions named by the supported contract; `jest.config.mts` and other
+ * spellings are not part of it, which only makes the guard narrower (it can drop hints, never add
+ * them). Presence of any listed name at the project root is enough; the file itself is never read or
+ * executed.
+ *
+ * Compared case-insensitively (see {@link hasRootJestConfigEntry}) because a case-insensitive
+ * filesystem treats `Jest.Config.JS` as the same file, and DepVitals must not disagree with itself
+ * about one project depending on the platform it runs on.
+ */
+const JEST_CONFIG_ENTRY_NAMES = new Set([
+    'jest.config.js',
+    'jest.config.mjs',
+    'jest.config.cjs',
+    'jest.config.ts',
+    'jest.config.json',
+]);
+/**
+ * Match the allowlisted subset of one `jest` configuration against the declared packages.
+ *
+ * Pure and side-effect free: it takes the raw `package.json#jest` JSON value (any shape, including
+ * something that is not an object) and the declared dependency names, and returns the declared
+ * packages named by `preset`, `testEnvironment` or the values of `transform`, in alphabetical order.
+ * Neither argument is mutated, and a candidate that is not declared is dropped, so this function can
+ * never describe an undeclared package as used.
+ *
+ * @param jestConfig - The raw `package.json#jest` value, validated here and never trusted.
+ * @param declaredPackageNames - Declared dependency names, the only names this may return.
+ */
+export function findJestConfigUsage(jestConfig, declaredPackageNames) {
+    if (!isPlainRecord(jestConfig)) {
+        return new Set();
+    }
+    const candidates = [
+        ...matchAllowedPackage(jestConfig['preset'], PRESET_PACKAGE_NAMES),
+        ...matchAllowedPackage(jestConfig['testEnvironment'], TEST_ENVIRONMENT_PACKAGE_NAMES),
+        ...matchTransformValues(jestConfig['transform'], TRANSFORM_PACKAGE_NAMES),
+    ];
+    const used = new Set();
+    for (const candidate of candidates) {
+        if (declaredPackageNames.has(candidate)) {
+            used.add(candidate);
+        }
+    }
+    // Rebuilt from sorted names so iteration is deterministic for every input.
+    return new Set([...used].sort(compareNames));
+}
+/**
+ * Collect the `package.json#jest` hints for the project rooted at `projectRoot`.
+ *
+ * The returned set is shaped for the analyzer's `configUsedNames` option (the Step 56 handoff), which
+ * is the only way configuration evidence reaches the analyzer. Nothing is decided here: the analyzer
+ * stays the sole owner of the unused/missing categories.
+ *
+ * No configuration problem is reported as an error. A missing manifest, an unreadable or invalid
+ * `package.json`, an unusable `jest` shape or an unreadable root all yield the empty set; the analyzer
+ * loads the manifest itself and remains the component that reports manifest failures, so this detector
+ * never replaces or duplicates that diagnosis.
+ *
+ * @param projectRoot - Project directory to inspect; resolved to an absolute path.
+ */
+export async function findJestManifestUsage(projectRoot) {
+    const root = resolve(projectRoot);
+    if (await hasRootJestConfigEntry(root)) {
+        return new Set();
+    }
+    let packageJsonPath;
+    let declaredPackageNames;
+    try {
+        const manifest = await loadProjectManifest(root);
+        packageJsonPath = manifest.packageJsonPath;
+        declaredPackageNames = manifest.declaredDependencyNames;
+    }
+    catch (error) {
+        if (error instanceof ProjectManifestError) {
+            return new Set();
+        }
+        throw error;
+    }
+    return findJestConfigUsage(await readJestConfigValue(packageJsonPath), declaredPackageNames);
+}
+/**
+ * Whether a root Jest configuration file name exists in the project root.
+ *
+ * The root directory is listed by name only (`readdir`), so no entry is opened, stat-followed, read or
+ * executed. An unreadable or missing root simply means no root Jest config is known to be present.
+ * Names are compared case-insensitively so a case-insensitive filesystem (typical on Windows and
+ * macOS) cannot hide a root Jest config from this guard.
+ */
+export async function hasRootJestConfigEntry(root) {
+    let entries;
+    try {
+        entries = await readdir(root);
+    }
+    catch {
+        return false;
+    }
+    return entries.some((entry) => JEST_CONFIG_ENTRY_NAMES.has(entry.toLowerCase()));
+}
+/**
+ * Read the raw `package.json#jest` value, ignoring everything that cannot be used.
+ *
+ * The manifest is read as text and parsed with `JSON.parse`, so no target-project code runs. An
+ * unreadable file, invalid JSON, a non-object document or an absent `jest` key all yield `undefined`;
+ * the loader-facing diagnosis of a broken manifest stays in {@link loadProjectManifest}.
+ */
+async function readJestConfigValue(packageJsonPath) {
+    let text;
+    try {
+        text = await readFile(packageJsonPath, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    return isPlainRecord(parsed) ? parsed['jest'] : undefined;
+}
+/**
+ * The single allowlisted package named by one static string value, if any.
+ *
+ * Only strings are considered: a number, `null`, an array or an object contributes nothing, so a
+ * malformed field never becomes evidence. The string is classified with the shared package-specifier
+ * rules, which reject relative and absolute paths (`"./local.js"`, `"/opt/preset.js"`) and URI forms
+ * such as `"file:./preset.js"` as internal or unsupported. Whatever package root survives must then
+ * be an exact member of `allowedPackages`, and that exact-name rule is what rejects the remaining
+ * resolver-shaped values, including `<rootDir>/presets/x.js` (its first segment `<rootDir>` is not a
+ * package name DepVitals will ever allow) and `"ts-jest-extras"`. There is no prefix, suffix,
+ * substring or case-insensitive matching, so `"jsdom"`, `"TS-Jest"` and
+ * `"jest-environment-node"` never match an entry.
+ */
+function matchAllowedPackage(value, allowedPackages) {
+    if (typeof value !== 'string') {
+        return [];
+    }
+    const specifier = classifyPackageSpecifier(value);
+    if (specifier.kind !== 'external') {
+        return [];
+    }
+    return allowedPackages.has(specifier.packageName) ? [specifier.packageName] : [];
+}
+/**
+ * The allowlisted packages named by the *values* of one `jest.transform` map.
+ *
+ * Only values are read: `Object.values` is used precisely so that a key can never become evidence.
+ * Every key of a Jest transform map is a regular expression such as `"^.+\\.tsx?$"`, and a key that
+ * happens to read `"ts-jest"` is still only a pattern, so it credits nothing. A `transform` field
+ * that is not a plain JSON object (an array, a string, a number, `null`, absent) contributes nothing.
+ */
+function matchTransformValues(transform, allowedPackages) {
+    if (!isPlainRecord(transform)) {
+        return [];
+    }
+    const matches = [];
+    for (const value of Object.values(transform)) {
+        matches.push(...matchTransformValue(value, allowedPackages));
+    }
+    return matches;
+}
+/**
+ * The allowlisted package named by one `jest.transform` value, if any.
+ *
+ * Exactly two shapes are supported, and no others:
+ *
+ * - the transformer string itself, `"ts-jest"`, matched by the same rules as the other supported
+ *   Jest fields - the value is classified first and must then be an exact member of
+ *   `allowedPackages`, so `"./local-transform.js"`, `"<rootDir>/transform.js"`, `"file:./t.js"`,
+ *   `""`, `"ts jest"`, `"ts-jest-extras"` and every other module yield nothing. As in `preset`, a
+ *   literal subpath of an allowlisted package collapses to its package root
+ *   (`"ts-jest/preprocessor.js"`, the historical ts-jest transformer path), because the first path
+ *   segment still names the package that provides the transformer;
+ * - the `[transformer, options]` tuple: exactly two elements, the second a JSON options object, the
+ *   first matched as above. The options object is only checked for being an object and is never
+ *   inspected, so a supported package name that appears only inside it - as a label or an option
+ *   value - is not evidence.
+ *
+ * A one- or three-element array, a non-object second tuple element, an object used in place of the
+ * whole value or any other shape is outside the supported subset and yields nothing.
+ */
+function matchTransformValue(value, allowedPackages) {
+    if (Array.isArray(value)) {
+        if (value.length !== 2 || !isPlainRecord(value[1])) {
+            return [];
+        }
+        return matchAllowedPackage(value[0], allowedPackages);
+    }
+    return matchAllowedPackage(value, allowedPackages);
+}
+/**
+ * A JSON object (not an array, not `null`) whose keys are strings.
+ */
+function isPlainRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Locale-independent lexicographic ordering, so the same configuration always yields the same order.
+ */
+function compareNames(a, b) {
+    if (a < b) {
+        return -1;
+    }
+    if (a > b) {
+        return 1;
+    }
+    return 0;
+}
+//# sourceMappingURL=jestManifestConfig.js.map

package/dist/detectors/jestManifestConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jestManifestConfig.js","sourceRoot":"","sources":["../../src/detectors/jestManifestConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAE1E;;;;;;;;;;;GAWG;AACH,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAEvE;;;;;;;;;;GAUG;AACH,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAEhG;;;;;;;;;GASG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAE1E;;;;;;;;;;;GAWG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;CACnB,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAmB,EACnB,oBAAyC;IAEzC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,GAAG,EAAU,CAAC;IAC3B,CAAC;IAED,MAAM,UAAU,GAAa;QAC3B,GAAG,mBAAmB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC;QAClE,GAAG,mBAAmB,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC;QACrF,GAAG,oBAAoB,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,uBAAuB,CAAC;KAC1E,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,OAAO,IAAI,GAAG,CAAS,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,WAAmB;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAElC,IAAI,MAAM,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,GAAG,EAAU,CAAC;IAC3B,CAAC;IAED,IAAI,eAAuB,CAAC;IAC5B,IAAI,oBAAyC,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACjD,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;QAC3C,oBAAoB,GAAG,QAAQ,CAAC,uBAAuB,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;YAC1C,OAAO,IAAI,GAAG,EAAU,CAAC;QAC3B,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO,mBAAmB,CAAC,MAAM,mBAAmB,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAY;IACvD,IAAI,OAAiB,CAAC;IAEtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CAAC,eAAuB;IACxD,IAAI,IAAY,CAAC;IAEjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,mBAAmB,CAC1B,KAAc,EACd,eAAoC;IAEpC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAElD,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,SAAkB,EAClB,eAAoC;IAEpC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,mBAAmB,CAC1B,KAAc,EACd,eAAoC;IAEpC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,mBAAmB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;AACrD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/reporters/terminalReporter.js

@@ -79,7 +79,33 @@ function findingsSections(result) {
 function renderSection(section) {
     const names = [...section.names].sort(compareNames);
     const count = String(names.length);
-    return [`${section.heading} (${count})`, ...names.map((name) => `  ${name}`)].join('\n');
+    // Package names come from target-project source, so a hostile name may carry a terminal control
+    // sequence (for example an ESC decoded from `"\x1b[2J"`). Escape C0/C1 control codes and DEL as
+    // `\uXXXX` before rendering, so the report can never alter the user's display.
+    return [
+        `${section.heading} (${count})`,
+        ...names.map((name) => `  ${escapeControlCharacters(name)}`),
+    ].join('\n');
+}
+/**
+ * Escape C0/C1 control characters and DEL as `\uXXXX` so a package name extracted from target
+ * source can never carry a terminal control sequence (such as an ESC from `"\x1b[2J"`) into the
+ * rendered report. Printable characters pass through unchanged.
+ *
+ * The scan is written as explicit code points instead of a control-character regex range so the
+ * ESLint `no-control-regex` rule stays meaningful.
+ */
+function escapeControlCharacters(value) {
+    let out = '';
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code < 0x20 || (code >= 0x7f && code <= 0x9f)) {
+            out += `\\u${code.toString(16).padStart(4, '0')}`;
+            continue;
+        }
+        out += value[index] ?? '';
+    }
+    return out;
 }
 /**
  * Locale-independent lexicographic (codepoint) ordering, matching the comparator convention already

package/dist/reporters/terminalReporter.js.map

@@ -1 +1 @@
-{"version":3,"file":"terminalReporter.js","sourceRoot":"","sources":["../../src/reporters/terminalReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,yDAAyD;AACzD,MAAM,MAAM,GAAG,WAAW,CAAC;AAE3B,2EAA2E;AAC3E,MAAM,YAAY,GAAG,GAAG,MAAM,mCAAmC,CAAC;AAQlE;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAsB;IACxD,OAAO,CACL,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;QACpC,MAAM,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC;QACvC,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CACtC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAsB;IACzD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAExF,OAAO,GAAG,MAAM,OAAO,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,MAAsB;IAC9C,OAAO;QACL,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,kBAAkB,EAAE;QACpE,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,CAAC,qBAAqB,EAAE;QAC1E,EAAE,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,mBAAmB,EAAE;KACvE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,OAAgB;IACrC,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEnC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"terminalReporter.js","sourceRoot":"","sources":["../../src/reporters/terminalReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,yDAAyD;AACzD,MAAM,MAAM,GAAG,WAAW,CAAC;AAE3B,2EAA2E;AAC3E,MAAM,YAAY,GAAG,GAAG,MAAM,mCAAmC,CAAC;AAQlE;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAsB;IACxD,OAAO,CACL,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;QACpC,MAAM,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC;QACvC,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CACtC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAsB;IACzD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAExF,OAAO,GAAG,MAAM,OAAO,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,MAAsB;IAC9C,OAAO;QACL,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,kBAAkB,EAAE;QACpE,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,CAAC,qBAAqB,EAAE;QAC1E,EAAE,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,mBAAmB,EAAE;KACvE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,OAAgB;IACrC,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEnC,gGAAgG;IAChG,gGAAgG;IAChG,+EAA+E;IAC/E,OAAO;QACL,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,GAAG;QAC/B,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;KAC7D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AACD;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,KAAa;IAC5C,IAAI,GAAG,GAAG,EAAE,CAAC;IAEb,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAErC,IAAI,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YAClD,GAAG,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YAClD,SAAS;QACX,CAAC;QAED,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/scanner/moduleSpecifiers.d.ts

@@ -48,6 +48,14 @@ export declare class ModuleSpecifierError extends Error {
     readonly offset: number;
     constructor(message: string, code: ModuleSpecifierErrorCode, offset: number);
 }
+/**
+ * Options for {@link extractModuleSpecifiers}.
+ */
+export type ExtractModuleSpecifiersOptions = {
+    jsx?: boolean;
+    /** Treat top-level `await` as a keyword. Omitted and false retain script/CommonJS behavior. */
+    module?: boolean;
+};
 /**
  * Extract the statically knowable module specifiers from `source`.
  *
@@ -56,5 +64,5 @@ export declare class ModuleSpecifierError extends Error {
  * @throws {ModuleSpecifierError} when the source reaches an unterminated or malformed lexical state
  *   from which the scanner cannot safely continue.
  */
-export declare function extractModuleSpecifiers(source: string): readonly ModuleSpecifierOccurrence[];
+export declare function extractModuleSpecifiers(source: string, options?: ExtractModuleSpecifiersOptions): readonly ModuleSpecifierOccurrence[];
 //# sourceMappingURL=moduleSpecifiers.d.ts.map

package/dist/scanner/moduleSpecifiers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"moduleSpecifiers.d.ts","sourceRoot":"","sources":["../../src/scanner/moduleSpecifiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,aAAa,GAAG,gBAAgB,GAAG,SAAS,CAAC;AAE1F;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;CACpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,CAAC;AAExD;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM;CAM5E;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,yBAAyB,EAAE,CAE5F"}
+{"version":3,"file":"moduleSpecifiers.d.ts","sourceRoot":"","sources":["../../src/scanner/moduleSpecifiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,aAAa,GAAG,gBAAgB,GAAG,SAAS,CAAC;AAE1F;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;CACpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,CAAC;AAExD;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM;CAM5E;AAED;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAI3C,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,+FAA+F;IAC/F,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,8BAAmC,GAC3C,SAAS,yBAAyB,EAAE,CAEtC"}