depvitals 0.1.2 → 0.3.0

package/dist/detectors/jestManifestConfig.d.ts

@@ -0,0 +1,76 @@
+/**
+ * `package.json#jest` usage detection.
+ *
+ * This module answers exactly one narrow question: which declared dependencies are named by the three
+ * explicit Jest fields this release understands inside the `jest` block of `package.json` — the
+ * top-level `preset` and `testEnvironment` strings and the values of the top-level `transform` map?
+ * The result is a set of configuration-only package names handed to the Step 56 analyzer seam, so a
+ * recognized name can only suppress an `unused` finding and can never create a `missing` one.
+ *
+ * It deliberately does not:
+ * - execute Jest, `import()`/`require()` its configuration loader, or evaluate any target code;
+ * - implement the Jest configuration schema. Only `preset`, `testEnvironment` and `transform` are
+ *   read, and only through the fixed allowlists below;
+ * - read the `transform` map *keys*. Every key of that map is a regular expression selecting the
+ *   files a transformer applies to, so a key is a pattern and never a package name, even when it
+ *   literally reads `"ts-jest"`; no regular expression is ever evaluated here;
+ * - expand Jest shorthands. In particular `testEnvironment: "jsdom"` is *not* credited to
+ *   `jest-environment-jsdom`: whether that shorthand is a package reference at all depends on the
+ *   Jest major version in use, which DepVitals does not read, so it stays outside the supported
+ *   subset of explicit package names;
+ * - interpret `<rootDir>/...`, `./...`, absolute paths, URLs or any other resolver-looking string as a
+ *   package reference;
+ * - read `jest.config.js`/`.cjs`/`.mjs`/`.ts`/`.json` contents. Those files are only checked for
+ *   presence, never opened here (source detection already handles their imports on its own);
+ * - guess a package from arbitrary configuration text, substring-match a value, or invent a name;
+ * - report anything about a package the manifest does not declare;
+ * - mutate the analyzed project.
+ *
+ * A conservative precedence guard applies before anything is read: when a root `jest.config.*` file
+ * exists, it is not provable which configuration Jest actually loads, so no `package.json#jest`
+ * hints are produced. Presence is checked by directory entry name only.
+ *
+ * The manifest model intentionally does not carry `jest`, so `package.json` is read a second time here
+ * as plain text (same trade-off as the legacy ESLint readers): the loader stays the validity gate and
+ * the single reporter of a broken manifest, while this detector silently ignores every shape it cannot
+ * use. Ignoring is deliberate — an unusable `jest` block is not an error, and diagnosing one here would
+ * duplicate the manifest loader.
+ */
+/**
+ * Match the allowlisted subset of one `jest` configuration against the declared packages.
+ *
+ * Pure and side-effect free: it takes the raw `package.json#jest` JSON value (any shape, including
+ * something that is not an object) and the declared dependency names, and returns the declared
+ * packages named by `preset`, `testEnvironment` or the values of `transform`, in alphabetical order.
+ * Neither argument is mutated, and a candidate that is not declared is dropped, so this function can
+ * never describe an undeclared package as used.
+ *
+ * @param jestConfig - The raw `package.json#jest` value, validated here and never trusted.
+ * @param declaredPackageNames - Declared dependency names, the only names this may return.
+ */
+export declare function findJestConfigUsage(jestConfig: unknown, declaredPackageNames: ReadonlySet<string>): ReadonlySet<string>;
+/**
+ * Collect the `package.json#jest` hints for the project rooted at `projectRoot`.
+ *
+ * The returned set is shaped for the analyzer's `configUsedNames` option (the Step 56 handoff), which
+ * is the only way configuration evidence reaches the analyzer. Nothing is decided here: the analyzer
+ * stays the sole owner of the unused/missing categories.
+ *
+ * No configuration problem is reported as an error. A missing manifest, an unreadable or invalid
+ * `package.json`, an unusable `jest` shape or an unreadable root all yield the empty set; the analyzer
+ * loads the manifest itself and remains the component that reports manifest failures, so this detector
+ * never replaces or duplicates that diagnosis.
+ *
+ * @param projectRoot - Project directory to inspect; resolved to an absolute path.
+ */
+export declare function findJestManifestUsage(projectRoot: string): Promise<ReadonlySet<string>>;
+/**
+ * Whether a root Jest configuration file name exists in the project root.
+ *
+ * The root directory is listed by name only (`readdir`), so no entry is opened, stat-followed, read or
+ * executed. An unreadable or missing root simply means no root Jest config is known to be present.
+ * Names are compared case-insensitively so a case-insensitive filesystem (typical on Windows and
+ * macOS) cannot hide a root Jest config from this guard.
+ */
+export declare function hasRootJestConfigEntry(root: string): Promise<boolean>;
+//# sourceMappingURL=jestManifestConfig.d.ts.map

package/dist/detectors/jestManifestConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jestManifestConfig.d.ts","sourceRoot":"","sources":["../../src/detectors/jestManifestConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAwEH;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,OAAO,EACnB,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,GACxC,WAAW,CAAC,MAAM,CAAC,CAqBrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAuB7F;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAW3E"}

package/dist/detectors/jestManifestConfig.js

@@ -0,0 +1,294 @@
+/**
+ * `package.json#jest` usage detection.
+ *
+ * This module answers exactly one narrow question: which declared dependencies are named by the three
+ * explicit Jest fields this release understands inside the `jest` block of `package.json` — the
+ * top-level `preset` and `testEnvironment` strings and the values of the top-level `transform` map?
+ * The result is a set of configuration-only package names handed to the Step 56 analyzer seam, so a
+ * recognized name can only suppress an `unused` finding and can never create a `missing` one.
+ *
+ * It deliberately does not:
+ * - execute Jest, `import()`/`require()` its configuration loader, or evaluate any target code;
+ * - implement the Jest configuration schema. Only `preset`, `testEnvironment` and `transform` are
+ *   read, and only through the fixed allowlists below;
+ * - read the `transform` map *keys*. Every key of that map is a regular expression selecting the
+ *   files a transformer applies to, so a key is a pattern and never a package name, even when it
+ *   literally reads `"ts-jest"`; no regular expression is ever evaluated here;
+ * - expand Jest shorthands. In particular `testEnvironment: "jsdom"` is *not* credited to
+ *   `jest-environment-jsdom`: whether that shorthand is a package reference at all depends on the
+ *   Jest major version in use, which DepVitals does not read, so it stays outside the supported
+ *   subset of explicit package names;
+ * - interpret `<rootDir>/...`, `./...`, absolute paths, URLs or any other resolver-looking string as a
+ *   package reference;
+ * - read `jest.config.js`/`.cjs`/`.mjs`/`.ts`/`.json` contents. Those files are only checked for
+ *   presence, never opened here (source detection already handles their imports on its own);
+ * - guess a package from arbitrary configuration text, substring-match a value, or invent a name;
+ * - report anything about a package the manifest does not declare;
+ * - mutate the analyzed project.
+ *
+ * A conservative precedence guard applies before anything is read: when a root `jest.config.*` file
+ * exists, it is not provable which configuration Jest actually loads, so no `package.json#jest`
+ * hints are produced. Presence is checked by directory entry name only.
+ *
+ * The manifest model intentionally does not carry `jest`, so `package.json` is read a second time here
+ * as plain text (same trade-off as the legacy ESLint readers): the loader stays the validity gate and
+ * the single reporter of a broken manifest, while this detector silently ignores every shape it cannot
+ * use. Ignoring is deliberate — an unusable `jest` block is not an error, and diagnosing one here would
+ * duplicate the manifest loader.
+ */
+import { readdir } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { loadProjectManifest, ProjectManifestError, readManifestText, } from '../scanner/projectManifest.js';
+import { assertReadableRoot, SourceFilesError } from '../scanner/sourceFiles.js';
+import { classifyPackageSpecifier } from '../scanner/packageSpecifier.js';
+/**
+ * The only `preset` packages recognized by this release.
+ *
+ * A fixed allowlist, not a resolution algorithm: `ts-jest` is supported because it is the published
+ * package name of the preset itself, so the string is already a complete package reference and needs
+ * no Jest-version knowledge to interpret. Any other preset name is unsupported and contributes no
+ * evidence, since guessing what an unknown preset string resolves to would create false confidence.
+ *
+ * A literal subpath of an allowlisted package (`"ts-jest/presets/default-esm"`) is accepted too,
+ * through the existing package-root normalization in {@link classifyPackageSpecifier}: the first path
+ * segment of such a specifier is the package that provides the preset.
+ */
+const PRESET_PACKAGE_NAMES = new Set(['ts-jest']);
+/**
+ * The only `testEnvironment` packages recognized by this release.
+ *
+ * Again the complete package name only; the `"jsdom"` shorthand is deliberately absent from this
+ * release. Where Jest accepts `"jsdom"`, it does resolve it to the separately installed
+ * `jest-environment-jsdom` package - but whether that shorthand is available at all depends on the
+ * Jest major version (up to v27 the jsdom environment shipped inside Jest itself, so such a project
+ * declares no package to credit), and DepVitals neither reads nor resolves the Jest version of an
+ * analyzed project. The supported subset is therefore fixed to the exact package name; shorthand
+ * resolution is a separate change that must first define which Jest versions it applies to.
+ */
+const TEST_ENVIRONMENT_PACKAGE_NAMES = new Set(['jest-environment-jsdom']);
+/**
+ * The only `transform` packages recognized by this release.
+ *
+ * A separate fixed allowlist rather than a reuse of the `preset` one: `ts-jest` is the only
+ * transformer credited, and it is supported for the same reason as the preset — the string is already
+ * the complete published package name, so nothing has to be resolved or versioned to interpret it.
+ * `jest-environment-jsdom` is deliberately absent, because a test environment is not a transformer;
+ * no other transform module is resolved, guessed, searched for in `node_modules` or matched by
+ * prefix, and transform maps are never flattened or searched recursively.
+ */
+const TRANSFORM_PACKAGE_NAMES = new Set(['ts-jest']);
+/**
+ * Root Jest configuration file names that disable `package.json#jest` hints.
+ *
+ * The list is fixed to the extensions named by the supported contract; `jest.config.mts` and other
+ * spellings are not part of it, which only makes the guard narrower (it can drop hints, never add
+ * them). Presence of any listed name at the project root is enough; the file itself is never read or
+ * executed.
+ *
+ * Compared case-insensitively (see {@link hasRootJestConfigEntry}) because a case-insensitive
+ * filesystem treats `Jest.Config.JS` as the same file, and DepVitals must not disagree with itself
+ * about one project depending on the platform it runs on.
+ */
+const JEST_CONFIG_ENTRY_NAMES = new Set([
+    'jest.config.js',
+    'jest.config.mjs',
+    'jest.config.cjs',
+    'jest.config.ts',
+    'jest.config.json',
+]);
+/**
+ * Match the allowlisted subset of one `jest` configuration against the declared packages.
+ *
+ * Pure and side-effect free: it takes the raw `package.json#jest` JSON value (any shape, including
+ * something that is not an object) and the declared dependency names, and returns the declared
+ * packages named by `preset`, `testEnvironment` or the values of `transform`, in alphabetical order.
+ * Neither argument is mutated, and a candidate that is not declared is dropped, so this function can
+ * never describe an undeclared package as used.
+ *
+ * @param jestConfig - The raw `package.json#jest` value, validated here and never trusted.
+ * @param declaredPackageNames - Declared dependency names, the only names this may return.
+ */
+export function findJestConfigUsage(jestConfig, declaredPackageNames) {
+    if (!isPlainRecord(jestConfig)) {
+        return new Set();
+    }
+    const candidates = [
+        ...matchAllowedPackage(jestConfig['preset'], PRESET_PACKAGE_NAMES),
+        ...matchAllowedPackage(jestConfig['testEnvironment'], TEST_ENVIRONMENT_PACKAGE_NAMES),
+        ...matchTransformValues(jestConfig['transform'], TRANSFORM_PACKAGE_NAMES),
+    ];
+    const used = new Set();
+    for (const candidate of candidates) {
+        if (declaredPackageNames.has(candidate)) {
+            used.add(candidate);
+        }
+    }
+    // Rebuilt from sorted names so iteration is deterministic for every input.
+    return new Set([...used].sort(compareNames));
+}
+/**
+ * Collect the `package.json#jest` hints for the project rooted at `projectRoot`.
+ *
+ * The returned set is shaped for the analyzer's `configUsedNames` option (the Step 56 handoff), which
+ * is the only way configuration evidence reaches the analyzer. Nothing is decided here: the analyzer
+ * stays the sole owner of the unused/missing categories.
+ *
+ * No configuration problem is reported as an error. A missing manifest, an unreadable or invalid
+ * `package.json`, an unusable `jest` shape or an unreadable root all yield the empty set; the analyzer
+ * loads the manifest itself and remains the component that reports manifest failures, so this detector
+ * never replaces or duplicates that diagnosis.
+ *
+ * @param projectRoot - Project directory to inspect; resolved to an absolute path.
+ */
+export async function findJestManifestUsage(projectRoot) {
+    const root = resolve(projectRoot);
+    if (await hasRootJestConfigEntry(root)) {
+        return new Set();
+    }
+    let packageJsonPath;
+    let declaredPackageNames;
+    try {
+        const manifest = await loadProjectManifest(root);
+        packageJsonPath = manifest.packageJsonPath;
+        declaredPackageNames = manifest.declaredDependencyNames;
+    }
+    catch (error) {
+        if (error instanceof ProjectManifestError || error instanceof SourceFilesError) {
+            return new Set();
+        }
+        throw error;
+    }
+    return findJestConfigUsage(await readJestConfigValue(packageJsonPath), declaredPackageNames);
+}
+/**
+ * Whether a root Jest configuration file name exists in the project root.
+ *
+ * The root directory is listed by name only (`readdir`), so no entry is opened, stat-followed, read or
+ * executed. An unreadable or missing root simply means no root Jest config is known to be present.
+ * Names are compared case-insensitively so a case-insensitive filesystem (typical on Windows and
+ * macOS) cannot hide a root Jest config from this guard.
+ */
+export async function hasRootJestConfigEntry(root) {
+    let entries;
+    try {
+        await assertReadableRoot(root);
+        entries = await readdir(root);
+    }
+    catch {
+        return false;
+    }
+    return entries.some((entry) => JEST_CONFIG_ENTRY_NAMES.has(entry.toLowerCase()));
+}
+/**
+ * Read the raw `package.json#jest` value, ignoring everything that cannot be used.
+ *
+ * The manifest is read as text and parsed with `JSON.parse`, so no target-project code runs. An
+ * unreadable file, invalid JSON, a non-object document or an absent `jest` key all yield `undefined`;
+ * the loader-facing diagnosis of a broken manifest stays in {@link loadProjectManifest}.
+ */
+async function readJestConfigValue(packageJsonPath) {
+    let text;
+    try {
+        text = await readManifestText(packageJsonPath);
+    }
+    catch {
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    return isPlainRecord(parsed) ? parsed['jest'] : undefined;
+}
+/**
+ * The single allowlisted package named by one static string value, if any.
+ *
+ * Only strings are considered: a number, `null`, an array or an object contributes nothing, so a
+ * malformed field never becomes evidence. The string is classified with the shared package-specifier
+ * rules, which reject relative and absolute paths (`"./local.js"`, `"/opt/preset.js"`) and URI forms
+ * such as `"file:./preset.js"` as internal or unsupported. Whatever package root survives must then
+ * be an exact member of `allowedPackages`, and that exact-name rule is what rejects the remaining
+ * resolver-shaped values, including `<rootDir>/presets/x.js` (its first segment `<rootDir>` is not a
+ * package name DepVitals will ever allow) and `"ts-jest-extras"`. There is no prefix, suffix,
+ * substring or case-insensitive matching, so `"jsdom"`, `"TS-Jest"` and
+ * `"jest-environment-node"` never match an entry.
+ */
+function matchAllowedPackage(value, allowedPackages) {
+    if (typeof value !== 'string') {
+        return [];
+    }
+    const specifier = classifyPackageSpecifier(value);
+    if (specifier.kind !== 'external') {
+        return [];
+    }
+    return allowedPackages.has(specifier.packageName) ? [specifier.packageName] : [];
+}
+/**
+ * The allowlisted packages named by the *values* of one `jest.transform` map.
+ *
+ * Only values are read: `Object.values` is used precisely so that a key can never become evidence.
+ * Every key of a Jest transform map is a regular expression such as `"^.+\\.tsx?$"`, and a key that
+ * happens to read `"ts-jest"` is still only a pattern, so it credits nothing. A `transform` field
+ * that is not a plain JSON object (an array, a string, a number, `null`, absent) contributes nothing.
+ */
+function matchTransformValues(transform, allowedPackages) {
+    if (!isPlainRecord(transform)) {
+        return [];
+    }
+    const matches = [];
+    for (const value of Object.values(transform)) {
+        matches.push(...matchTransformValue(value, allowedPackages));
+    }
+    return matches;
+}
+/**
+ * The allowlisted package named by one `jest.transform` value, if any.
+ *
+ * Exactly two shapes are supported, and no others:
+ *
+ * - the transformer string itself, `"ts-jest"`, matched by the same rules as the other supported
+ *   Jest fields - the value is classified first and must then be an exact member of
+ *   `allowedPackages`, so `"./local-transform.js"`, `"<rootDir>/transform.js"`, `"file:./t.js"`,
+ *   `""`, `"ts jest"`, `"ts-jest-extras"` and every other module yield nothing. As in `preset`, a
+ *   literal subpath of an allowlisted package collapses to its package root
+ *   (`"ts-jest/preprocessor.js"`, the historical ts-jest transformer path), because the first path
+ *   segment still names the package that provides the transformer;
+ * - the `[transformer, options]` tuple: exactly two elements, the second a JSON options object, the
+ *   first matched as above. The options object is only checked for being an object and is never
+ *   inspected, so a supported package name that appears only inside it - as a label or an option
+ *   value - is not evidence.
+ *
+ * A one- or three-element array, a non-object second tuple element, an object used in place of the
+ * whole value or any other shape is outside the supported subset and yields nothing.
+ */
+function matchTransformValue(value, allowedPackages) {
+    if (Array.isArray(value)) {
+        if (value.length !== 2 || !isPlainRecord(value[1])) {
+            return [];
+        }
+        return matchAllowedPackage(value[0], allowedPackages);
+    }
+    return matchAllowedPackage(value, allowedPackages);
+}
+/**
+ * A JSON object (not an array, not `null`) whose keys are strings.
+ */
+function isPlainRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Locale-independent lexicographic ordering, so the same configuration always yields the same order.
+ */
+function compareNames(a, b) {
+    if (a < b) {
+        return -1;
+    }
+    if (a > b) {
+        return 1;
+    }
+    return 0;
+}
+//# sourceMappingURL=jestManifestConfig.js.map

package/dist/detectors/jestManifestConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jestManifestConfig.js","sourceRoot":"","sources":["../../src/detectors/jestManifestConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAE1E;;;;;;;;;;;GAWG;AACH,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAEvE;;;;;;;;;;GAUG;AACH,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAEhG;;;;;;;;;GASG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAE1E;;;;;;;;;;;GAWG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;CACnB,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAmB,EACnB,oBAAyC;IAEzC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,GAAG,EAAU,CAAC;IAC3B,CAAC;IAED,MAAM,UAAU,GAAa;QAC3B,GAAG,mBAAmB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC;QAClE,GAAG,mBAAmB,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC;QACrF,GAAG,oBAAoB,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,uBAAuB,CAAC;KAC1E,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,OAAO,IAAI,GAAG,CAAS,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,WAAmB;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAElC,IAAI,MAAM,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,GAAG,EAAU,CAAC;IAC3B,CAAC;IAED,IAAI,eAAuB,CAAC;IAC5B,IAAI,oBAAyC,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACjD,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;QAC3C,oBAAoB,GAAG,QAAQ,CAAC,uBAAuB,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,oBAAoB,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YAC/E,OAAO,IAAI,GAAG,EAAU,CAAC;QAC3B,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO,mBAAmB,CAAC,MAAM,mBAAmB,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAY;IACvD,IAAI,OAAiB,CAAC;IAEtB,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CAAC,eAAuB;IACxD,IAAI,IAAY,CAAC;IAEjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,mBAAmB,CAC1B,KAAc,EACd,eAAoC;IAEpC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAElD,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,SAAkB,EAClB,eAAoC;IAEpC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,mBAAmB,CAC1B,KAAc,EACd,eAAoC;IAEpC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,mBAAmB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;AACrD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/reporters/terminalReporter.js

@@ -79,7 +79,33 @@ function findingsSections(result) {
 function renderSection(section) {
     const names = [...section.names].sort(compareNames);
     const count = String(names.length);
-    return [`${section.heading} (${count})`, ...names.map((name) => `  ${name}`)].join('\n');
+    // Package names come from target-project source, so a hostile name may carry a terminal control
+    // sequence (for example an ESC decoded from `"\x1b[2J"`). Escape C0/C1 control codes and DEL as
+    // `\uXXXX` before rendering, so the report can never alter the user's display.
+    return [
+        `${section.heading} (${count})`,
+        ...names.map((name) => `  ${escapeControlCharacters(name)}`),
+    ].join('\n');
+}
+/**
+ * Escape C0/C1 control characters and DEL as `\uXXXX` so a package name extracted from target
+ * source can never carry a terminal control sequence (such as an ESC from `"\x1b[2J"`) into the
+ * rendered report. Printable characters pass through unchanged.
+ *
+ * The scan is written as explicit code points instead of a control-character regex range so the
+ * ESLint `no-control-regex` rule stays meaningful.
+ */
+function escapeControlCharacters(value) {
+    let out = '';
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code < 0x20 || (code >= 0x7f && code <= 0x9f)) {
+            out += `\\u${code.toString(16).padStart(4, '0')}`;
+            continue;
+        }
+        out += value[index] ?? '';
+    }
+    return out;
 }
 /**
  * Locale-independent lexicographic (codepoint) ordering, matching the comparator convention already

package/dist/reporters/terminalReporter.js.map

@@ -1 +1 @@
-{"version":3,"file":"terminalReporter.js","sourceRoot":"","sources":["../../src/reporters/terminalReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,yDAAyD;AACzD,MAAM,MAAM,GAAG,WAAW,CAAC;AAE3B,2EAA2E;AAC3E,MAAM,YAAY,GAAG,GAAG,MAAM,mCAAmC,CAAC;AAQlE;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAsB;IACxD,OAAO,CACL,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;QACpC,MAAM,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC;QACvC,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CACtC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAsB;IACzD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAExF,OAAO,GAAG,MAAM,OAAO,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,MAAsB;IAC9C,OAAO;QACL,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,kBAAkB,EAAE;QACpE,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,CAAC,qBAAqB,EAAE;QAC1E,EAAE,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,mBAAmB,EAAE;KACvE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,OAAgB;IACrC,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEnC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"terminalReporter.js","sourceRoot":"","sources":["../../src/reporters/terminalReporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,yDAAyD;AACzD,MAAM,MAAM,GAAG,WAAW,CAAC;AAE3B,2EAA2E;AAC3E,MAAM,YAAY,GAAG,GAAG,MAAM,mCAAmC,CAAC;AAQlE;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAsB;IACxD,OAAO,CACL,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;QACpC,MAAM,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC;QACvC,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CACtC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAsB;IACzD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAExF,OAAO,GAAG,MAAM,OAAO,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,MAAsB;IAC9C,OAAO;QACL,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,kBAAkB,EAAE;QACpE,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,CAAC,qBAAqB,EAAE;QAC1E,EAAE,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,mBAAmB,EAAE;KACvE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,OAAgB;IACrC,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEnC,gGAAgG;IAChG,gGAAgG;IAChG,+EAA+E;IAC/E,OAAO;QACL,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,GAAG;QAC/B,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;KAC7D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AACD;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,KAAa;IAC5C,IAAI,GAAG,GAAG,EAAE,CAAC;IAEb,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAErC,IAAI,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YAClD,GAAG,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YAClD,SAAS;QACX,CAAC;QAED,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/scanner/moduleSpecifiers.d.ts

@@ -48,6 +48,14 @@ export declare class ModuleSpecifierError extends Error {
     readonly offset: number;
     constructor(message: string, code: ModuleSpecifierErrorCode, offset: number);
 }
+/**
+ * Options for {@link extractModuleSpecifiers}.
+ */
+export type ExtractModuleSpecifiersOptions = {
+    jsx?: boolean;
+    /** Explicit module/script grammar, or bounded syntax detection for ambiguous `.js` input. */
+    module?: boolean | 'detect';
+};
 /**
  * Extract the statically knowable module specifiers from `source`.
  *
@@ -56,5 +64,5 @@ export declare class ModuleSpecifierError extends Error {
  * @throws {ModuleSpecifierError} when the source reaches an unterminated or malformed lexical state
  *   from which the scanner cannot safely continue.
  */
-export declare function extractModuleSpecifiers(source: string): readonly ModuleSpecifierOccurrence[];
+export declare function extractModuleSpecifiers(source: string, options?: ExtractModuleSpecifiersOptions): readonly ModuleSpecifierOccurrence[];
 //# sourceMappingURL=moduleSpecifiers.d.ts.map

package/dist/scanner/moduleSpecifiers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"moduleSpecifiers.d.ts","sourceRoot":"","sources":["../../src/scanner/moduleSpecifiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,aAAa,GAAG,gBAAgB,GAAG,SAAS,CAAC;AAE1F;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;CACpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,CAAC;AAExD;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM;CAM5E;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,yBAAyB,EAAE,CAE5F"}
+{"version":3,"file":"moduleSpecifiers.d.ts","sourceRoot":"","sources":["../../src/scanner/moduleSpecifiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,aAAa,GAAG,gBAAgB,GAAG,SAAS,CAAC;AAE1F;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;CACpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,CAAC;AAExD;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM;CAM5E;AAED;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAI3C,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6FAA6F;IAC7F,MAAM,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC7B,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,8BAAmC,GAC3C,SAAS,yBAAyB,EAAE,CAStC"}