depvitals 0.1.2 → 0.3.0

package/dist/core/analyzeProject.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzeProject.d.ts","sourceRoot":"","sources":["../../src/core/analyzeProject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAUH;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,uDAAuD;IACvD,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,+FAA+F;IAC/F,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,GAAG,gBAAgB,CAAC;AAEvE;;;;;;;GAOG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;gBAErB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,EAAE,OAAO;CAKtE;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CA6CjF"}
+{"version":3,"file":"analyzeProject.d.ts","sourceRoot":"","sources":["../../src/core/analyzeProject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAeH;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,uDAAuD;IACvD,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,+FAA+F;IAC/F,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;AAEnD;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACxD,iGAAiG;IACjG,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrD,4FAA4F;IAC5F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC7D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,GAAG,gBAAgB,CAAC;AAEvE;;;;;;;GAOG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;gBAErB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,CAAC,EAAE,OAAO;CAKtE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,cAAc,CAAC,CA6DzB"}

package/dist/core/analyzeProject.js

@@ -24,26 +24,34 @@
  * once and parsed once. No concurrency pool, cache or index is introduced before a measured need
  * appears.
  *
- * Usage/missing formulas (`usedNames` is the union of source-external package roots and script-used
- * package names; `declaredDependencyNames` is the union of every declared dependency section):
+ * Usage/missing formulas (`usedNames` is the union of source-external package roots, script-used
+ * package names and validated configuration-only package names; `declaredDependencyNames` is the
+ * union of every declared dependency section):
  *
  * ```text
  * sourceUsedNames = external package roots extracted from source files
  * scriptUsedNames = findPackageScriptUsage(scripts, dependencies ∪ devDependencies)
- * usedNames       = sourceUsedNames ∪ scriptUsedNames
+ * configUsedNames = validated configuration-only names handed to the analyzer (empty for now)
+ * usedNames       = sourceUsedNames ∪ scriptUsedNames ∪ configUsedNames
  * unusedDependencies    = dependencies    − usedNames
  * unusedDevDependencies = devDependencies − usedNames
  * missingDependencies   = sourceUsedNames − declaredDependencyNames
  * ```
  *
- * Scripts never generate missing-dependency findings, and peer/optional declarations suppress false
- * missing results through `declaredDependencyNames`.
+ * The evidence sources are deliberately asymmetric:
+ * - source imports and requires may contribute to `missingDependencies`;
+ * - package scripts and validated static tool configuration may only suppress an unused finding and
+ *   can never create a missing finding, because a command or configuration string is not evidence
+ *   that source code references the package.
+ *
+ * Peer/optional declarations suppress false missing results through `declaredDependencyNames`.
  */
 import { readFile } from 'node:fs/promises';
-import { loadProjectManifest } from '../scanner/projectManifest.js';
+import { dirname } from 'node:path';
+import { loadPackageScope, loadProjectManifest, } from '../scanner/projectManifest.js';
 import { discoverSourceFiles } from '../scanner/sourceFiles.js';
 import { extractModuleSpecifiers } from '../scanner/moduleSpecifiers.js';
-import { classifyPackageSpecifier } from '../scanner/packageSpecifier.js';
+import { classifyPackageSpecifier, isPackageSelfReference } from '../scanner/packageSpecifier.js';
 import { findPackageScriptUsage } from '../scanner/scriptUsage.js';
 /**
  * Operational error for the dependency-analysis engine.
@@ -67,18 +75,29 @@ export class AnalysisError extends Error {
  * The supplied root is resolved to an absolute path; `process.cwd()` is never changed and the target
  * project is never written to.
  *
+ * @param projectRoot - Directory to analyze.
+ * @param options - Optional static tool hints and validated source exclusions; omitted inputs change nothing.
  * @throws {AnalysisError} when a discovered source file cannot be read or cannot be safely analyzed.
  * @throws {ProjectManifestError} when the manifest is missing, unreadable, invalid or malformed.
  * @throws {SourceFilesError} when the root is missing, is not a directory, or cannot be read.
  */
-export async function analyzeProject(projectRoot) {
+export async function analyzeProject(projectRoot, options = {}) {
     const manifest = await loadProjectManifest(projectRoot);
-    const sourceFiles = await discoverSourceFiles(manifest.root);
+    const sourceFiles = await discoverSourceFiles(manifest.root, {
+        ignorePaths: options.ignorePaths,
+    });
     // External package roots referenced by source files, collapsed to their package root.
     const sourceUsedNames = new Set();
+    // Seed the selected root so scope lookup never consults a parent outside the scan.
+    const scopeByDirectory = new Map([
+        [manifest.root, { packageType: manifest.packageType, selfReference: manifest.selfReference }],
+    ]);
     for (const file of sourceFiles) {
-        const specifiers = await readAndExtract(file);
+        const scope = await packageScopeForDirectory(dirname(file), scopeByDirectory);
+        const specifiers = await readAndExtract(file, scope.packageType);
         for (const specifier of specifiers) {
+            if (isPackageSelfReference(specifier, scope.selfReference))
+                continue;
             const classified = classifyPackageSpecifier(specifier);
             if (classified.kind === 'external') {
                 sourceUsedNames.add(classified.packageName);
@@ -92,19 +111,42 @@ export async function analyzeProject(projectRoot) {
         Object.keys(manifest.devDependencies),
     ]);
     const scriptUsedNames = findPackageScriptUsage(manifest.scripts, declaredCandidates);
-    const usedNames = unionNames([[...sourceUsedNames], [...scriptUsedNames]]);
+    // Configuration evidence never reaches `sourceUsedNames`, which is the only input able to produce
+    // a missing finding; it can only make `usedNames` bigger and therefore suppress unused findings.
+    const configUsedNames = normalizeConfigHints(options.configUsedNames);
+    const usedNames = unionNames([[...sourceUsedNames], [...scriptUsedNames], [...configUsedNames]]);
     const unusedDependencies = declaredMinus(Object.keys(manifest.dependencies), usedNames);
     const unusedDevDependencies = declaredMinus(Object.keys(manifest.devDependencies), usedNames);
     // An external root is missing only when it is absent from every declared dependency section.
     // Peer/optional declarations therefore suppress false missing results.
     const missingDependencies = declaredMinus([...sourceUsedNames], manifest.declaredDependencyNames);
+    // Exclusions are policy, not evidence: classify against the complete inventory first so script
+    // collisions and all other packages keep their ordinary meaning. Retained sources must already
+    // have been read and parsed successfully before any finding can be suppressed.
+    const ignoredDependencies = new Set(options.ignoreDependencies ?? []);
     return {
         projectRoot: manifest.root,
-        unusedDependencies,
-        unusedDevDependencies,
-        missingDependencies,
+        unusedDependencies: unusedDependencies.filter((name) => !ignoredDependencies.has(name)),
+        unusedDevDependencies: unusedDevDependencies.filter((name) => !ignoredDependencies.has(name)),
+        missingDependencies: missingDependencies.filter((name) => !ignoredDependencies.has(name)),
     };
 }
+/**
+ * Resolve the nearest package scope for one discovered source file.
+ *
+ * An existing nested `package.json` starts a new scope even when it omits `type`; directories
+ * without one inherit their parent. Ownership and module mode share this walk and cache. The
+ * selected root is always seeded before lookup, so traversal stops there.
+ */
+async function packageScopeForDirectory(directory, cache) {
+    const cached = cache.get(directory);
+    if (cached !== undefined)
+        return cached;
+    const ownScope = await loadPackageScope(directory);
+    const scope = ownScope ?? (await packageScopeForDirectory(dirname(directory), cache));
+    cache.set(directory, scope);
+    return scope;
+}
 /**
  * Read a discovered source file and extract its statically known specifiers.
  *
@@ -113,7 +155,7 @@ export async function analyzeProject(projectRoot) {
  * preserve the original error as `cause` and include the affected path, so a broken file never
  * yields a partial result or a misleading "clean" analysis.
  */
-async function readAndExtract(file) {
+async function readAndExtract(file, packageType) {
     let source;
     try {
         source = await readFile(file, 'utf8');
@@ -121,8 +163,35 @@ async function readAndExtract(file) {
     catch (error) {
         throw new AnalysisError(`Could not read source file ${file}: ${messageOf(error)}`, 'unreadable-source', error);
     }
+    /**
+     * Determine the narrow Node source mode needed for top-level `await`.
+     *
+     * Explicit module extensions win over the package type. CommonJS extensions remain scripts even
+     * under a module package. Ambiguous `.js` scopes use bounded syntax detection; JSX/TypeScript
+     * extensions retain the existing nearest-scope `type: "module"` policy.
+     */
+    function sourceModuleMode(file, packageType) {
+        const lower = file.toLowerCase();
+        if (lower.endsWith('.mjs') || lower.endsWith('.mts')) {
+            return true;
+        }
+        if (lower.endsWith('.cjs') || lower.endsWith('.cts')) {
+            return false;
+        }
+        if (lower.endsWith('.js') && packageType !== 'module' && packageType !== 'commonjs') {
+            return 'detect';
+        }
+        return ((lower.endsWith('.js') ||
+            lower.endsWith('.jsx') ||
+            lower.endsWith('.ts') ||
+            lower.endsWith('.tsx')) &&
+            packageType === 'module');
+    }
     try {
-        const occurrences = extractModuleSpecifiers(source);
+        const occurrences = extractModuleSpecifiers(source, {
+            jsx: usesJsxSyntax(file, source),
+            module: sourceModuleMode(file, packageType),
+        });
         return occurrences.map((occurrence) => occurrence.specifier);
     }
     catch (error) {
@@ -132,6 +201,44 @@ async function readAndExtract(file) {
         throw error;
     }
 }
+/**
+ * Whether a discovered source file may contain JSX syntax.
+ *
+ * `.jsx` and `.tsx` always enable the extractor's bounded JSX mode. Plain JavaScript extensions
+ * (`.js`, `.mjs` and `.cjs`) enable it only when the source contains a JSX-like closing or
+ * self-closing tag. TypeScript extensions other than `.tsx` stay in plain mode, so a `.ts` type
+ * assertion (`<Foo>value`) is never mistaken for markup. Extension checks are case-insensitive.
+ */
+function usesJsxSyntax(file, source) {
+    const lower = file.toLowerCase();
+    if (lower.endsWith('.jsx') || lower.endsWith('.tsx')) {
+        return true;
+    }
+    return /\.(?:js|mjs|cjs)$/.test(lower) && /<\/[A-Za-z]|\/>/.test(source);
+}
+/**
+ * Turn the internal configuration handoff into validated package roots.
+ *
+ * The entries come from configuration reading code, not from the trusted analyzer, so each one is
+ * re-validated with the same utility that classifies source specifiers. Builtins, relative or
+ * absolute paths, malformed scoped names, URIs, whitespace and version suffixes are dropped instead
+ * of being trusted as package names. Accepted entries collapse to their package root and are
+ * deduplicated case-sensitively; an omitted set behaves exactly like an empty one.
+ */
+function normalizeConfigHints(hints) {
+    const names = new Set();
+    if (hints === undefined) {
+        return names;
+    }
+    for (const hint of hints) {
+        const classified = classifyPackageSpecifier(hint);
+        if (classified.kind === 'external') {
+            names.add(classified.packageName);
+        }
+    }
+    // Rebuilt from sorted names so iteration order never depends on the caller's set insertion order.
+    return new Set([...names].sort(compareNames));
+}
 /**
  * Union of the names of every supplied list, sorted alphabetically.
  */

package/dist/core/analyzeProject.js.map

@@ -1 +1 @@
-{"version":3,"file":"analyzeProject.js","sourceRoot":"","sources":["../../src/core/analyzeProject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AA+BnE;;;;;;;GAOG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,CAAoB;IAEjC,YAAY,OAAe,EAAE,IAAuB,EAAE,KAAe;QACnE,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,WAAmB;IACtD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAExD,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7D,sFAAsF;IACtF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAE9C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAEvD,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACnC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IAED,gGAAgG;IAChG,0FAA0F;IAC1F,MAAM,kBAAkB,GAAG,UAAU,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;KACtC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAErF,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAE3E,MAAM,kBAAkB,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;IAExF,MAAM,qBAAqB,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC,CAAC;IAE9F,6FAA6F;IAC7F,uEAAuE;IACvE,MAAM,mBAAmB,GAAG,aAAa,CAAC,CAAC,GAAG,eAAe,CAAC,EAAE,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAElG,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,IAAI;QAC1B,kBAAkB;QAClB,qBAAqB;QACrB,mBAAmB;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,IAAI,MAAc,CAAC;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,aAAa,CACrB,8BAA8B,IAAI,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,EACzD,mBAAmB,EACnB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACpE,MAAM,IAAI,aAAa,CACrB,eAAe,IAAI,2BAA2B,SAAS,CAAC,KAAK,CAAC,EAAE,EAChE,gBAAgB,EAChB,KAAK,CACN,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,KAAqC;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,QAA2B,EAAE,IAAyB;IAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"analyzeProject.js","sourceRoot":"","sources":["../../src/core/analyzeProject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,gBAAgB,EAChB,mBAAmB,GAEpB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAkEnE;;;;;;;GAOG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,CAAoB;IAEjC,YAAY,OAAe,EAAE,IAAuB,EAAE,KAAe;QACnE,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAAmB,EACnB,UAA2B,EAAE;IAE7B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAExD,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE;QAC3D,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IAEH,sFAAsF;IACtF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,mFAAmF;IACnF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAA+B;QAC7D,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;KAC9F,CAAC,CAAC;IAEH,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAEjE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,sBAAsB,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC;gBAAE,SAAS;YACrE,MAAM,UAAU,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAEvD,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACnC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IAED,gGAAgG;IAChG,0FAA0F;IAC1F,MAAM,kBAAkB,GAAG,UAAU,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;KACtC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAErF,kGAAkG;IAClG,iGAAiG;IACjG,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAEtE,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAEjG,MAAM,kBAAkB,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;IAExF,MAAM,qBAAqB,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC,CAAC;IAE9F,6FAA6F;IAC7F,uEAAuE;IACvE,MAAM,mBAAmB,GAAG,aAAa,CAAC,CAAC,GAAG,eAAe,CAAC,EAAE,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAElG,+FAA+F;IAC/F,+FAA+F;IAC/F,+EAA+E;IAC/E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;IACtE,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,IAAI;QAC1B,kBAAkB,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvF,qBAAqB,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7F,mBAAmB,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,wBAAwB,CACrC,SAAiB,EACjB,KAAwC;IAExC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,QAAQ,IAAI,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACtF,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAY,EACZ,WAA+B;IAE/B,IAAI,MAAc,CAAC;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,aAAa,CACrB,8BAA8B,IAAI,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,EACzD,mBAAmB,EACnB,KAAK,CACN,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,WAA+B;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAEjC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;YACpF,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,CACL,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YACpB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YACtB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YACrB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzB,WAAW,KAAK,QAAQ,CACzB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE;YAClD,GAAG,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC;YAChC,MAAM,EAAE,gBAAgB,CAAC,IAAI,EAAE,WAAW,CAAC;SAC5C,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACpE,MAAM,IAAI,aAAa,CACrB,eAAe,IAAI,2BAA2B,SAAS,CAAC,KAAK,CAAC,EAAE,EAChE,gBAAgB,EAChB,KAAK,CACN,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,MAAc;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAEjC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,KAAmC;IAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAElD,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,OAAO,IAAI,GAAG,CAAS,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,KAAqC;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,QAA2B,EAAE,IAAyB;IAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/detectors/eslintManifestConfig.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Legacy `package.json#eslintConfig` usage detection.
+ *
+ * This module answers exactly one narrow question: which declared dependencies are referenced by a
+ * small, explicitly enumerated subset of the legacy ESLint configuration block stored inside
+ * `package.json`? The result is a set of configuration-only package names that is handed to the
+ * Step 56 analyzer seam, so a recognized name can only suppress an `unused` finding and can never
+ * create a `missing` one.
+ *
+ * It deliberately does not:
+ * - evaluate, `import()`, `require()` or otherwise run ESLint, a config loader or any target code;
+ * - implement the ESLint configuration schema. Only `extends` and `plugins` are read, and only
+ *   through the fixed allowlists below;
+ * - resolve `overrides`, scoped plugin shorthands, `plugin:<name>/<config>` forms other than the one
+ *   allowlisted string, shareable-config subpaths, or external `.eslintrc.*` files, which are read
+ *   by the sibling `findEslintRcJsonUsage` reader instead of duplicating these tables;
+ * - guess a package from arbitrary configuration text, substring-match a value, or invent a name;
+ * - report anything about a package the manifest does not declare;
+ * - mutate the analyzed project.
+ *
+ * The manifest model intentionally does not carry `eslintConfig`, so `package.json` is read a second
+ * time here as plain text: the loader is reused as the validity gate, and one extra small read beats
+ * widening the manifest model for one detector. Every unusable shape is ignored rather than
+ * diagnosed: manifest validity stays with the manifest loader and the analyzer, which report a
+ * genuinely invalid `package.json` as they always have.
+ *
+ * A conservative precedence guard applies before anything is read: when a hard barrier (a modern
+ * flat-config entrypoint, or a legacy `.eslintrc.js`/`.cjs`/`.yaml`/`.yml`) exists at the project
+ * root, the legacy block is not provably the active configuration, so no legacy hints are produced
+ * from either source. Presence is checked by directory entry name only; no entry is read,
+ * interpreted or executed. The precedence is computed once by {@link readLegacyEslintPrecedence},
+ * shared by both legacy readers, so the two sources obey exactly one set of rules.
+ */
+/**
+ * The legacy ESLint precedence state for one project root, computed once by both readers so the two
+ * legacy sources obey exactly one set of rules.
+ *
+ * - `hardBarrier`: a flat config or `.eslintrc.js`/`.cjs`/`.yaml`/`.yml` exists, which disables every
+ *   legacy hint from both sources;
+ * - `legacyRcByName`: a legacy `.eslintrc.json` or extensionless `.eslintrc` exists by name, which
+ *   displaces the manifest block but does not by itself stop the `.eslintrc.json` reader.
+ *
+ * Presence is checked by directory entry name only; no entry is opened, stat-followed, read or
+ * executed, and an unreadable root simply means no barrier is known to exist.
+ */
+export type LegacyEslintPrecedence = {
+    readonly hardBarrier: boolean;
+    readonly legacyRcByName: boolean;
+    readonly legacyRcJsonEntryName: string | undefined;
+};
+/**
+ * Compute the legacy ESLint precedence state for the project rooted at `projectRoot`.
+ *
+ * The two legacy readers ({@link findEslintManifestUsage} and {@link findEslintRcJsonUsage}) share
+ * this so a hard barrier disables both, `.eslintrc.json` wins over the manifest block, and an
+ * extensionless `.eslintrc` displaces only the manifest block. Neither reader unions the displaced
+ * source, so two contradictory legacy configurations are never combined.
+ *
+ * The legacy `.eslintrc.json` name is resolved case-insensitively, so the matched directory entry
+ * name is returned as `legacyRcJsonEntryName` for the JSON reader to reuse.
+ *
+ * @param projectRoot - Project directory to inspect; resolved to an absolute path.
+ */
+export declare function readLegacyEslintPrecedence(projectRoot: string): Promise<LegacyEslintPrecedence>;
+/**
+ * Match the allowlisted subset of one legacy `eslintConfig` value against the declared packages.
+ *
+ * Pure and side-effect free: it takes the raw `eslintConfig` JSON value (any shape, including
+ * something that is not an object) and the declared dependency names, and returns the declared
+ * packages that have configuration-only evidence, in alphabetical order. Neither argument is
+ * mutated, and a candidate that is not declared is dropped, so this function can never describe an
+ * undeclared package as used.
+ *
+ * @param eslintConfig - The raw `package.json#eslintConfig` value, validated here and never trusted.
+ * @param declaredPackageNames - Declared dependency names, the only names this may return.
+ */
+export declare function findEslintConfigUsage(eslintConfig: unknown, declaredPackageNames: ReadonlySet<string>): ReadonlySet<string>;
+/**
+ * Collect the legacy `package.json#eslintConfig` hints for the project rooted at `projectRoot`.
+ *
+ * The returned set is shaped for the analyzer's `configUsedNames` option (the Step 56 handoff),
+ * which is the only way configuration evidence reaches the analyzer. Nothing is decided here: the
+ * analyzer stays the sole owner of the unused/missing categories.
+ *
+ * No configuration problem is reported as an error. A missing manifest, an unreadable or invalid
+ * `package.json`, an unusable `eslintConfig` shape or an unreadable root all yield the empty set;
+ * the analyzer loads the manifest itself and remains the component that reports manifest failures,
+ * so this detector never replaces or duplicates that diagnosis.
+ *
+ * Legacy precedence (Step 68.1) is delegated to {@link readLegacyEslintPrecedence}, which both
+ * legacy readers share: a hard barrier disables this block outright, and any legacy `.eslintrc.*`
+ * by name displaces it in favour of the lower-priority `.eslintrc.json` reader. This reader never
+ * unions the displaced source, so the two legacy configurations are never combined.
+ *
+ * @param projectRoot - Project directory to inspect; resolved to an absolute path.
+ */
+export declare function findEslintManifestUsage(projectRoot: string): Promise<ReadonlySet<string>>;
+/**
+ * Whether the project rooted at `projectRoot` contains a modern flat-config entrypoint (see
+ * {@link FLAT_CONFIG_ENTRY_NAMES}).
+ *
+ * A flat config is a hard barrier: its presence disables every legacy hint, including the
+ * `package.json#eslintConfig` block, so it is checked before any legacy reader contributes a hint.
+ * This is a thin convenience for callers that only need the flat-config question. Only flat-config
+ * entrypoints count: a legacy `.eslintrc.*` file reports `false`, even though it still participates
+ * in the hard-barrier check inside the legacy readers.
+ *
+ * @param projectRoot - Project directory to inspect; resolved to an absolute path.
+ */
+export declare function hasFlatConfigEntry(projectRoot: string): Promise<boolean>;
+//# sourceMappingURL=eslintManifestConfig.d.ts.map

package/dist/detectors/eslintManifestConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eslintManifestConfig.d.ts","sourceRoot":"","sources":["../../src/detectors/eslintManifestConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAiGH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC;CACpD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,sBAAsB,CAAC,CA+BjC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,OAAO,EACrB,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,GACxC,WAAW,CAAC,MAAM,CAAC,CAoBrB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAwB/F;AAaD;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU9E"}