depvitals 0.2.0 → 0.3.0

package/dist/scanner/packageSpecifier.js

@@ -3,11 +3,13 @@
  *
  * This module classifies a single raw module specifier into a small set of categories without
  * executing code, reading the filesystem or consulting `node_modules`. It is a pure transformation
- * that sits between specifier extraction (Step 9) and dependency analysis (Step 12).
+ * that sits between specifier extraction (Step 9) and dependency analysis (Step 12). Separate internal
+ * helpers prepare bounded exact self-reference metadata without altering ordinary classification.
  *
  * It deliberately does not:
  * - decide whether a specifier is used, unused or missing (that belongs to the analyzer);
- * - resolve files on disk, `node_modules`, package `exports`, TS `paths` or bundler aliases;
+ * - resolve files on disk, `node_modules`, TS `paths` or bundler aliases;
+ * - implement general package `exports` resolution (conditions, patterns and fallbacks);
  * - validate a name against npm registry publication rules (names are compared case-sensitively);
  * - read `package.json#imports`, so `#` import aliases cannot be resolved here.
  *
@@ -95,4 +97,70 @@ function isMalformed(specifier) {
         specifier.includes('?') ||
         specifier.includes('%'));
 }
+/**
+ * Prepare the bounded self-reference subset from static JSON metadata, without I/O or mutation.
+ * Only a direct root string or an object consisting entirely of exact keys and safe string targets
+ * is supported. Mixed/conditional/pattern/array exports are deliberately not partially interpreted.
+ * This helper does not load metadata or change analyzer findings.
+ */
+export function createPackageSelfReferenceScope(metadata) {
+    const rawName = metadata['name'];
+    const name = typeof rawName === 'string' && !rawName.includes('*') && !hasControlCharacter(rawName)
+        ? rawName
+        : undefined;
+    const exports = metadata['exports'];
+    const exportedSubpaths = new Set();
+    if (typeof exports === 'string') {
+        if (isSafeExportPath(exports))
+            exportedSubpaths.add('.');
+    }
+    else if (typeof exports === 'object' && exports !== null && !Array.isArray(exports)) {
+        const entries = Object.entries(exports);
+        if (entries.every(([key, target]) => (key === '.' || isSafeExportPath(key)) &&
+            typeof target === 'string' &&
+            isSafeExportPath(target))) {
+            for (const [key] of entries)
+                exportedSubpaths.add(key);
+        }
+    }
+    return { name, exportedSubpaths };
+}
+/**
+ * Match the raw specifier before package-root normalization. A same-name declaration alone is not
+ * evidence of ownership, and builtin/unsupported references cannot become self references.
+ * Neither target existence nor runtime resolution is consulted.
+ */
+export function isPackageSelfReference(specifier, scope) {
+    if (scope?.name === undefined)
+        return false;
+    const key = specifier === scope.name
+        ? '.'
+        : specifier.startsWith(`${scope.name}/`)
+            ? `./${specifier.slice(scope.name.length + 1)}`
+            : undefined;
+    if (key === undefined || !scope.exportedSubpaths.has(key))
+        return false;
+    const classified = classifyPackageSpecifier(specifier);
+    return classified.kind === 'external' && classified.packageName === scope.name;
+}
+/** A deliberately literal subset: no normalization, URL decoding, patterns or path resolution. */
+function isSafeExportPath(value) {
+    if (!value.startsWith('./') || /[\\%*?:#]/.test(value) || hasControlCharacter(value))
+        return false;
+    return value
+        .slice(2)
+        .split('/')
+        .every((segment) => segment !== '' &&
+        segment !== '.' &&
+        segment !== '..' &&
+        segment.toLowerCase() !== 'node_modules');
+}
+function hasControlCharacter(value) {
+    for (const character of value) {
+        const code = character.charCodeAt(0);
+        if (code < 32 || code === 127)
+            return true;
+    }
+    return false;
+}
 //# sourceMappingURL=packageSpecifier.js.map

package/dist/scanner/packageSpecifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"packageSpecifier.js","sourceRoot":"","sources":["../../src/scanner/packageSpecifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAiBxC;;;;;GAKG;AACH,MAAM,cAAc,GAAG,2BAA2B,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,kGAAkG;IAClG,2FAA2F;IAC3F,mDAAmD;IACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,8FAA8F;IAC9F,0FAA0F;IAC1F,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,+CAA+C;IAC/C,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IAED,8FAA8F;IAC9F,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,2FAA2F;IAC3F,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED,4FAA4F;IAC5F,sEAAsE;IACtE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,mCAAmC;QACnC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,KAAK,IAAI,WAAW,EAAE,EAAE,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,SAAiB;IACpC,OAAO,CACL,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QACpB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CACxB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"packageSpecifier.js","sourceRoot":"","sources":["../../src/scanner/packageSpecifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAiBxC;;;;;GAKG;AACH,MAAM,cAAc,GAAG,2BAA2B,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,kGAAkG;IAClG,2FAA2F;IAC3F,mDAAmD;IACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,8FAA8F;IAC9F,0FAA0F;IAC1F,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,+CAA+C;IAC/C,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IAED,8FAA8F;IAC9F,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,2FAA2F;IAC3F,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED,4FAA4F;IAC5F,sEAAsE;IACtE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,mCAAmC;QACnC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,KAAK,IAAI,WAAW,EAAE,EAAE,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,SAAiB;IACpC,OAAO,CACL,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QACpB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CACxB,CAAC;AACJ,CAAC;AAYD;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAA2C;IAE3C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,IAAI,GACR,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC;QACpF,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,gBAAgB,CAAC,OAAO,CAAC;YAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;SAAM,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,IACE,OAAO,CAAC,KAAK,CACX,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAChB,CAAC,GAAG,KAAK,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACtC,OAAO,MAAM,KAAK,QAAQ;YAC1B,gBAAgB,CAAC,MAAM,CAAC,CAC3B,EACD,CAAC;YACD,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO;gBAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,KAA4C;IAE5C,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,GAAG,GACP,SAAS,KAAK,KAAK,CAAC,IAAI;QACtB,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC;YACtC,CAAC,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE;YAC/C,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,MAAM,UAAU,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACvD,OAAO,UAAU,CAAC,IAAI,KAAK,UAAU,IAAI,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,CAAC;AACjF,CAAC;AAED,kGAAkG;AAClG,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,OAAO,KAAK;SACT,KAAK,CAAC,CAAC,CAAC;SACR,KAAK,CAAC,GAAG,CAAC;SACV,KAAK,CACJ,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,KAAK,EAAE;QACd,OAAO,KAAK,GAAG;QACf,OAAO,KAAK,IAAI;QAChB,OAAO,CAAC,WAAW,EAAE,KAAK,cAAc,CAC3C,CAAC;AACN,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,IAAI,GAAG,EAAE,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/scanner/projectManifest.d.ts

@@ -16,6 +16,7 @@
  * text is read as UTF-8 without any BOM handling: a manifest that `JSON.parse` rejects is reported
  * as invalid instead of being silently normalized.
  */
+import { type PackageSelfReferenceScope } from './packageSpecifier.js';
 /**
  * A dependency section: package name mapped to the version specifier declared for it.
  *
@@ -43,16 +44,22 @@ export type ProjectManifest = {
     scripts: Readonly<Record<string, string>>;
     /** Root package type, used only to classify `.js` top-level await without executing config. */
     packageType: string | undefined;
+    /** Bounded exact exports ownership; never a dependency inventory. */
+    selfReference: PackageSelfReferenceScope;
 };
 /** The package-type hint declared by one package scope, or `undefined` when no manifest exists. */
 export type PackageTypeHint = {
     packageType: string | undefined;
 };
+/** One existing package scope, including nameless/no-exports scope boundaries. */
+export type PackageScopeMetadata = PackageTypeHint & {
+    selfReference: PackageSelfReferenceScope;
+};
 /**
  * Why a manifest could not be turned into a {@link ProjectManifest}.
  *
  * - `missing`: no `package.json` exists at the expected path.
- * - `unreadable`: the file exists but could not be read (permissions, not a directory, ...).
+ * - `unreadable`: the entry is linked/non-regular, or a present file could not be read.
  * - `invalid-json`: the file content is not valid JSON.
  * - `invalid-shape`: the JSON is valid but its structure is not what the model requires.
  */
@@ -73,14 +80,23 @@ export declare class ProjectManifestError extends Error {
  *
  * @throws {ProjectManifestError} when the manifest is missing, unreadable, invalid JSON, or has an
  * unexpected structure.
+ * @throws {SourceFilesError} when the selected root is linked or is not a directory.
  */
 export declare function loadProjectManifest(projectRoot: string): Promise<ProjectManifest>;
 /**
  * Read only the static `type` hint from the manifest in `directory`.
  *
- * Source-mode resolution calls this for nested package scopes. A missing manifest means that the
+ * The combined scope reader below supplies analysis with ownership too. A missing manifest means the
  * parent scope remains applicable; an existing manifest with no string `type` starts a new scope
- * with script/CommonJS behavior.
+ * whose `.js` files are ambiguous rather than inheriting the parent's explicit module mode.
  */
 export declare function loadPackageTypeHint(directory: string): Promise<PackageTypeHint | undefined>;
+/** Read module mode and bounded ownership together, with the same mandatory manifest guard. */
+export declare function loadPackageScope(directory: string): Promise<PackageScopeMetadata | undefined>;
+/**
+ * Read mandatory manifest text only from a non-linked regular file. Only absence at lstat means
+ * no scope; a present entry that cannot be read (including disappearance after lstat) is an error.
+ * This checks stable filesystem entries, not adversarial replacement between calls.
+ */
+export declare function readManifestText(packageJsonPath: string): Promise<string>;
 //# sourceMappingURL=projectManifest.d.ts.map

package/dist/scanner/projectManifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projectManifest.d.ts","sourceRoot":"","sources":["../../src/scanner/projectManifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,aAAa,CAAC;IAC5B,eAAe,EAAE,aAAa,CAAC;IAC/B,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7C,2DAA2D;IAC3D,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,+FAA+F;IAC/F,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,CAAC;AAEF,mGAAmG;AACnG,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,YAAY,GAAG,cAAc,GAAG,eAAe,CAAC;AAInG;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;gBAE5B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,OAAO;CAK7E;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAYvF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAiCjG"}
+{"version":3,"file":"projectManifest.d.ts","sourceRoot":"","sources":["../../src/scanner/projectManifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,aAAa,CAAC;IAC5B,eAAe,EAAE,aAAa,CAAC;IAC/B,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7C,2DAA2D;IAC3D,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,+FAA+F;IAC/F,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,qEAAqE;IACrE,aAAa,EAAE,yBAAyB,CAAC;CAC1C,CAAC;AAEF,mGAAmG;AACnG,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,CAAC;AAEF,kFAAkF;AAClF,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG;IACnD,aAAa,EAAE,yBAAyB,CAAC;CAC1C,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,YAAY,GAAG,cAAc,GAAG,eAAe,CAAC;AAInG;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;gBAE5B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,OAAO;CAK7E;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAiBvF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAGjG;AAED,+FAA+F;AAC/F,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CA6B3C;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB/E"}

package/dist/scanner/projectManifest.js

@@ -16,8 +16,10 @@
  * text is read as UTF-8 without any BOM handling: a manifest that `JSON.parse` rejects is reported
  * as invalid instead of being silently normalized.
  */
-import { readFile } from 'node:fs/promises';
+import { lstat, readFile } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
+import { assertReadableRoot, SourceFilesError } from './sourceFiles.js';
+import { createPackageSelfReferenceScope, } from './packageSpecifier.js';
 const MANIFEST_FILENAME = 'package.json';
 /**
  * Operational error for manifest loading. The `code` lets callers (the CLI in a later step) render
@@ -39,37 +41,47 @@ export class ProjectManifestError extends Error {
  *
  * @throws {ProjectManifestError} when the manifest is missing, unreadable, invalid JSON, or has an
  * unexpected structure.
+ * @throws {SourceFilesError} when the selected root is linked or is not a directory.
  */
 export async function loadProjectManifest(projectRoot) {
     const root = resolve(projectRoot);
     const packageJsonPath = join(root, MANIFEST_FILENAME);
-    let text;
     try {
-        text = await readFile(packageJsonPath, 'utf8');
+        await assertReadableRoot(root);
     }
     catch (error) {
-        throw toReadError(packageJsonPath, error);
+        // Preserve manifest-loader diagnostics for missing/unreadable roots, but reject linked roots
+        // with the same typed root error as source discovery before any target input is consulted.
+        if (error instanceof SourceFilesError && error.code !== 'not-a-directory') {
+            throw toReadError(packageJsonPath, error.cause ?? error);
+        }
+        throw error;
     }
+    const text = await readManifestText(packageJsonPath);
     return parseManifest(root, packageJsonPath, text);
 }
 /**
  * Read only the static `type` hint from the manifest in `directory`.
  *
- * Source-mode resolution calls this for nested package scopes. A missing manifest means that the
+ * The combined scope reader below supplies analysis with ownership too. A missing manifest means the
  * parent scope remains applicable; an existing manifest with no string `type` starts a new scope
- * with script/CommonJS behavior.
+ * whose `.js` files are ambiguous rather than inheriting the parent's explicit module mode.
  */
 export async function loadPackageTypeHint(directory) {
+    const scope = await loadPackageScope(directory);
+    return scope === undefined ? undefined : { packageType: scope.packageType };
+}
+/** Read module mode and bounded ownership together, with the same mandatory manifest guard. */
+export async function loadPackageScope(directory) {
     const packageJsonPath = join(resolve(directory), MANIFEST_FILENAME);
     let text;
     try {
-        text = await readFile(packageJsonPath, 'utf8');
+        text = await readManifestText(packageJsonPath);
     }
     catch (error) {
-        if (isNotFoundError(error)) {
+        if (error instanceof ProjectManifestError && error.code === 'missing')
             return undefined;
-        }
-        throw new ProjectManifestError(`Could not read ${MANIFEST_FILENAME} at ${packageJsonPath}`, 'unreadable', error);
+        throw error;
     }
     let parsed;
     try {
@@ -81,11 +93,37 @@ export async function loadPackageTypeHint(directory) {
     if (!isPlainRecord(parsed)) {
         throw new ProjectManifestError(`${packageJsonPath} must contain a JSON object`, 'invalid-shape');
     }
-    return { packageType: readOptionalString(parsed, 'type') };
+    return {
+        packageType: readOptionalString(parsed, 'type'),
+        selfReference: createPackageSelfReferenceScope(parsed),
+    };
+}
+/**
+ * Read mandatory manifest text only from a non-linked regular file. Only absence at lstat means
+ * no scope; a present entry that cannot be read (including disappearance after lstat) is an error.
+ * This checks stable filesystem entries, not adversarial replacement between calls.
+ */
+export async function readManifestText(packageJsonPath) {
+    let info;
+    try {
+        info = await lstat(packageJsonPath);
+    }
+    catch (error) {
+        throw toReadError(packageJsonPath, error);
+    }
+    if (!info.isFile()) {
+        throw new ProjectManifestError(`${packageJsonPath} must be a regular file; symlinks and non-regular entries are not read`, 'unreadable');
+    }
+    try {
+        return await readFile(packageJsonPath, 'utf8');
+    }
+    catch (error) {
+        throw new ProjectManifestError(`Could not read ${MANIFEST_FILENAME} at ${packageJsonPath}`, 'unreadable', error);
+    }
 }
 /**
  * Classify a filesystem failure: a missing manifest is expected and reported separately from any
- * other I/O problem. A root that turns out to be a file surfaces as `ENOTDIR` and stays unreadable.
+ * other I/O problem. Missing nested scopes may inherit only when the entry was absent at lstat.
  */
 function toReadError(packageJsonPath, error) {
     if (isNotFoundError(error)) {
@@ -133,6 +171,7 @@ function parseManifest(root, packageJsonPath, text) {
         ]),
         scripts,
         packageType,
+        selfReference: createPackageSelfReferenceScope(parsed),
     };
     return name === undefined ? manifest : { ...manifest, name };
 }

package/dist/scanner/projectManifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"projectManifest.js","sourceRoot":"","sources":["../../src/scanner/projectManifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+C1C,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,IAAI,CAA2B;IAExC,YAAY,OAAe,EAAE,IAA8B,EAAE,KAAe;QAC1E,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,WAAmB;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAEtD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAEpE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,oBAAoB,CAC5B,kBAAkB,iBAAiB,OAAO,eAAe,EAAE,EAC3D,YAAY,EACZ,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAAC,GAAG,eAAe,oBAAoB,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,6BAA6B,EAC/C,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,eAAuB,EAAE,KAAc;IAC1D,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,oBAAoB,CAC7B,MAAM,iBAAiB,aAAa,eAAe,EAAE,EACrD,SAAS,EACT,KAAK,CACN,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,oBAAoB,CAC7B,kBAAkB,iBAAiB,OAAO,eAAe,EAAE,EAC3D,YAAY,EACZ,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,eAAuB,EAAE,IAAY;IACxE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAAC,GAAG,eAAe,oBAAoB,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,6BAA6B,EAC/C,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IAC/E,MAAM,eAAe,GAAG,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC;IACrF,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;IAC/F,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,EAAE,eAAe,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAoB;QAChC,IAAI;QACJ,eAAe;QACf,YAAY;QACZ,eAAe;QACf,uBAAuB,EAAE,aAAa,CAAC;YACrC,YAAY;YACZ,eAAe;YACf,oBAAoB;YACpB,gBAAgB;SACjB,CAAC;QACF,OAAO;QACP,WAAW;KACZ,CAAC;IAEF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAiC,EAAE,GAAW;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,QAAiC,EAAE,eAAuB;IAC1E,MAAM,KAAK,GAAY,QAAQ,CAAC,MAAM,CAAC,CAAC;IAExC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,6CAA6C,EAC/D,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,QAAiC,EACjC,OAAe,EACf,eAAuB;IAEvB,MAAM,KAAK,GAAY,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,WAAW,OAAO,sCAAsC,EAC1E,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,WAAW,OAAO,2CAA2C,GAAG,mBAAmB,EACrG,eAAe,CAChB,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE/C,0FAA0F;IAC1F,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,QAAkC;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,sFAAsF;IACtF,OAAO,IAAI,GAAG,CAAS,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"projectManifest.js","sourceRoot":"","sources":["../../src/scanner/projectManifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,+BAA+B,GAEhC,MAAM,uBAAuB,CAAC;AAsD/B,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,IAAI,CAA2B;IAExC,YAAY,OAAe,EAAE,IAA8B,EAAE,KAAe;QAC1E,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,WAAmB;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6FAA6F;QAC7F,2FAA2F;QAC3F,IAAI,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC1E,MAAM,WAAW,CAAC,eAAe,EAAE,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAErD,OAAO,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;AAC9E,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAiB;IAEjB,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAEpE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,oBAAoB,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxF,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAAC,GAAG,eAAe,oBAAoB,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,6BAA6B,EAC/C,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,WAAW,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC;QAC/C,aAAa,EAAE,+BAA+B,CAAC,MAAM,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,eAAuB;IAC5D,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,wEAAwE,EAC1F,YAAY,CACb,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAC5B,kBAAkB,iBAAiB,OAAO,eAAe,EAAE,EAC3D,YAAY,EACZ,KAAK,CACN,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,eAAuB,EAAE,KAAc;IAC1D,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,oBAAoB,CAC7B,MAAM,iBAAiB,aAAa,eAAe,EAAE,EACrD,SAAS,EACT,KAAK,CACN,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,oBAAoB,CAC7B,kBAAkB,iBAAiB,OAAO,eAAe,EAAE,EAC3D,YAAY,EACZ,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,eAAuB,EAAE,IAAY;IACxE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAAC,GAAG,eAAe,oBAAoB,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,6BAA6B,EAC/C,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IAC/E,MAAM,eAAe,GAAG,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC;IACrF,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;IAC/F,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,EAAE,eAAe,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAoB;QAChC,IAAI;QACJ,eAAe;QACf,YAAY;QACZ,eAAe;QACf,uBAAuB,EAAE,aAAa,CAAC;YACrC,YAAY;YACZ,eAAe;YACf,oBAAoB;YACpB,gBAAgB;SACjB,CAAC;QACF,OAAO;QACP,WAAW;QACX,aAAa,EAAE,+BAA+B,CAAC,MAAM,CAAC;KACvD,CAAC;IAEF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAiC,EAAE,GAAW;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,QAAiC,EAAE,eAAuB;IAC1E,MAAM,KAAK,GAAY,QAAQ,CAAC,MAAM,CAAC,CAAC;IAExC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,6CAA6C,EAC/D,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,QAAiC,EACjC,OAAe,EACf,eAAuB;IAEvB,MAAM,KAAK,GAAY,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,WAAW,OAAO,sCAAsC,EAC1E,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,WAAW,OAAO,2CAA2C,GAAG,mBAAmB,EACrG,eAAe,CAChB,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE/C,0FAA0F;IAC1F,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,QAAkC;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,sFAAsF;IACtF,OAAO,IAAI,GAAG,CAAS,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/scanner/scriptUsage.d.ts

@@ -38,7 +38,8 @@
  * that is still open at the end of the script. Each such region is consumed as an opaque block, so a
  * separator inside it never delimits the surrounding script. An invalidated segment yields no
  * evidence at all, while the neighbouring segments delimited by real supported separators are still
- * analyzed normally.
+ * analyzed normally. Here-document payloads stay opaque; scanning resumes only after a proven
+ * literal closing delimiter. Unknown headers discard the unproven remainder.
  */
 /**
  * Recognize the declared dependencies that `package.json` scripts clearly reference.

package/dist/scanner/scriptUsage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scriptUsage.d.ts","sourceRoot":"","sources":["../../src/scanner/scriptUsage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AA6TH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,GACxC,WAAW,CAAC,MAAM,CAAC,CAYrB"}
+{"version":3,"file":"scriptUsage.d.ts","sourceRoot":"","sources":["../../src/scanner/scriptUsage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AA6TH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,GACxC,WAAW,CAAC,MAAM,CAAC,CAYrB"}

package/dist/scanner/scriptUsage.js

@@ -38,7 +38,8 @@
  * that is still open at the end of the script. Each such region is consumed as an opaque block, so a
  * separator inside it never delimits the surrounding script. An invalidated segment yields no
  * evidence at all, while the neighbouring segments delimited by real supported separators are still
- * analyzed normally.
+ * analyzed normally. Here-document payloads stay opaque; scanning resumes only after a proven
+ * literal closing delimiter. Unknown headers discard the unproven remainder.
  */
 import { classifyPackageSpecifier } from './packageSpecifier.js';
 /**
@@ -466,7 +467,8 @@ function matchRunnerPackage(significant) {
  * (Step 68.1). Unsupported constructs (single `&`, redirection, `$(...)`, `${...}`, quotes left open
  * at the end of the script) mark the current segment as unsupported instead of guessing tokens from
  * inside it. The marker is reset by the next real separator, so invalidation stays local to the
- * affected segment.
+ * affected segment. Here-document payloads are the exception: a literal closing delimiter must be
+ * proven before scanning resumes; unknown headers discard the unproven remainder.
  */
 function splitSegments(script) {
     const segments = [];
@@ -502,6 +504,17 @@ function splitSegments(script) {
             i = skipCommentToEndOfLine(script, i);
             continue;
         }
+        // A here-document owns its entire payload, including apparent commands and quotes.
+        // Only the bounded literal header can establish a trusted resumption point.
+        if (ch === '<' && script[i + 1] === '<') {
+            const next = unsupported ? undefined : skipHereDocument(script, i);
+            unsupported = true;
+            if (next === undefined)
+                break;
+            i = next;
+            flush();
+            continue;
+        }
         // Supported separators. `&&`/`||` are two-character; `;`, `|` and newline are single-character.
         if (ch === ';' || ch === '\n') {
             i += 1;
@@ -541,6 +554,64 @@ function splitSegments(script) {
     segments.push({ tokens, unsupported });
     return segments;
 }
+/** Locate a single literal << / <<- payload without interpreting or expanding any of it. */
+function skipHereDocument(script, start) {
+    let i = start + 2;
+    const stripTabs = script[i] === '-';
+    if (stripTabs)
+        i++;
+    while (script[i] === ' ' || script[i] === '\t')
+        i++;
+    const quote = script[i] === "'" || script[i] === '"' ? script[i++] : undefined;
+    const delimiterStart = i;
+    while (i < script.length && /[A-Za-z0-9_]/.test(script[i] ?? ''))
+        i++;
+    if (i === delimiterStart)
+        return undefined;
+    const delimiter = script.slice(delimiterStart, i);
+    if (quote !== undefined) {
+        if (script[i] !== quote)
+            return undefined;
+        i++;
+    }
+    const delimiterEnd = i;
+    while (script[i] === ' ' || script[i] === '\t')
+        i++;
+    // An adjacent # is part of the delimiter word, not a shell comment.
+    if (i > delimiterEnd && script[i] === '#')
+        i = skipCommentToEndOfLine(script, i);
+    if (script[i] === '\r' && script[i + 1] === '\n')
+        i++;
+    if (script[i] !== '\n')
+        return undefined;
+    i++;
+    while (i < script.length) {
+        const newline = script.indexOf('\n', i);
+        let end = newline < 0 ? script.length : newline;
+        if (newline >= 0 && script[end - 1] === '\r')
+            end--;
+        if (quote === undefined && newline >= 0) {
+            // Unquoted payloads remove an unescaped backslash-newline before delimiter matching.
+            // Logical-line reconstruction is outside the resume subset: do not trust the remainder.
+            let escapeStart = end;
+            while (escapeStart > i && script[escapeStart - 1] === '\\')
+                escapeStart--;
+            if ((end - escapeStart) % 2 === 1)
+                return undefined;
+        }
+        let content = i;
+        if (stripTabs)
+            while (script[content] === '\t')
+                content++;
+        if (script.slice(content, end) === delimiter) {
+            return newline < 0 ? script.length : newline + 1;
+        }
+        if (newline < 0)
+            return undefined;
+        i = newline + 1;
+    }
+    return undefined;
+}
 /**
  * Skip a POSIX comment that starts at `start`, which must point at a `#`, and return the index just
  * at the next LF, or the end of the script when none follows.
@@ -578,6 +649,9 @@ function scanToken(script, start) {
         if (isWhitespace(ch) || ch === ';' || ch === '\n' || ch === '|' || ch === '&') {
             break;
         }
+        // Let the outer scanner consume a here-document even when it is attached to a word.
+        if (ch === '<' && script[i + 1] === '<')
+            break;
         // Redirection is not parsed in v0.1.0; its presence alone invalidates the segment.
         if (ch === '<' || ch === '>') {
             unsupported = true;
@@ -689,6 +763,10 @@ function isUnsupportedRegionStart(script, index) {
  * cannot close a region either. A single quote is literal text inside a double-quoted run, which is
  * the one quote form that does not nest.
  *
+ * Inside $(), command-position grouping parentheses own their closers and word-boundary comments
+ * stay inert through LF. Literal here-document boundaries are delegated to the same bounded helper.
+ * Arithmetic, case patterns, function declarations and unprovable group boundaries retain the remainder.
+ *
  * If EOF is reached first the region is unterminated and `script.length` is returned, leaving the
  * current outer segment unsupported. This never interprets shell semantics; it only locates opaque
  * region boundaries safely.
@@ -696,83 +774,150 @@ function isUnsupportedRegionStart(script, index) {
 function skipUnsupportedRegion(script, start) {
     const length = script.length;
     const stack = [];
+    const push = (close, group = false) => {
+        stack.push({ close, group, wordBoundary: true, commandStart: true });
+    };
+    const pop = () => {
+        const closed = stack.pop();
+        const parent = stack.at(-1);
+        if (parent !== undefined) {
+            parent.wordBoundary = closed?.group === true;
+            parent.commandStart = false;
+        }
+    };
     const first = script[start];
     const second = script[start + 1];
     let i;
     if (first === '`') {
-        stack.push('`');
+        push('`');
         i = start + 1;
     }
     else if (first === '$' && (second === '(' || second === '{')) {
-        stack.push(second === '(' ? ')' : '}');
+        if (second === '(' && script[start + 2] === '(')
+            return length;
+        push(second === '(' ? ')' : '}');
         i = start + 2;
     }
     else {
-        // Not a region opener; advance by one so a caller can never loop forever.
         return start + 1;
     }
     while (i < length && stack.length > 0) {
         const ch = script[i];
-        if (ch === undefined) {
-            break;
-        }
         const top = stack.at(-1);
-        // Inside single quotes everything is literal, so only the closing single quote is special.
-        if (top === "'") {
-            if (ch === "'") {
-                stack.pop();
-            }
-            i += 1;
+        if (ch === undefined || top === undefined)
+            break;
+        if (top.close === "'") {
+            if (ch === "'")
+                pop();
+            i++;
             continue;
         }
-        // A backslash consumes the next character in `$()`, `${}`, backticks and double quotes.
         if (ch === '\\') {
+            // A removed line continuation does not begin a new shell word.
+            if (script[i + 1] !== '\n') {
+                top.wordBoundary = false;
+                top.commandStart = false;
+            }
             i += 2;
             continue;
         }
         if (ch === "'" || ch === '"') {
-            // A single quote is literal text inside a double-quoted run, so it must never open a region of
-            // its own. Doing so would keep the outer double quote open until EOF and hide the separators
-            // that follow it.
-            if (ch === "'" && top === '"') {
-                i += 1;
+            if (ch === "'" && top.close === '"') {
+                i++;
                 continue;
             }
-            // A double quote closes only the quoted run it opened; any other quote opens a literal run.
-            if (ch === '"' && top === '"') {
-                stack.pop();
-            }
+            if (ch === '"' && top.close === '"')
+                pop();
             else {
-                stack.push(ch);
+                top.wordBoundary = false;
+                top.commandStart = false;
+                push(ch);
             }
-            i += 1;
+            i++;
             continue;
         }
         const next = script[i + 1];
         if (ch === '$' && opensExpansion(next)) {
-            stack.push(next === '(' ? ')' : '}');
+            if (next === '(' && script[i + 2] === '(')
+                return length;
+            top.wordBoundary = false;
+            top.commandStart = false;
+            push(next === '(' ? ')' : '}');
             i += 2;
             continue;
         }
         if (ch === '`') {
-            if (top === '`') {
-                stack.pop();
-            }
+            if (top.close === '`')
+                pop();
             else {
-                stack.push('`');
+                top.wordBoundary = false;
+                top.commandStart = false;
+                push('`');
             }
-            i += 1;
+            i++;
             continue;
         }
-        // `)` and `}` close only a matching region; otherwise they are inert region content.
-        if ((ch === ')' || ch === '}') && ch === top) {
-            stack.pop();
+        if (top.close === ')') {
+            if (ch === '#' && top.wordBoundary) {
+                i = skipCommentToEndOfLine(script, i);
+                continue;
+            }
+            // A standalone pipeline negation leaves the following command in command position.
+            if (ch === '!' && top.commandStart && isRegionWordBoundary(next)) {
+                top.wordBoundary = true;
+                i++;
+                continue;
+            }
+            // These reserved words leave the next word in command position.
+            if (top.commandStart && top.wordBoundary) {
+                const lead = ['if', 'then', 'do', 'else', 'elif', 'while', 'until', 'time', '{'].find((word) => script.startsWith(word, i) && isRegionWordBoundary(script[i + word.length]));
+                if (lead !== undefined) {
+                    i += lead.length;
+                    top.wordBoundary = true;
+                    continue;
+                }
+            }
+            // Case patterns and arithmetic/function syntax cannot be balanced as simple groups.
+            if (top.commandStart &&
+                ['case', 'function'].some((word) => script.startsWith(word, i) && isRegionWordBoundary(script[i + word.length])))
+                return length;
+            if (ch === '<' && next === '<') {
+                const after = skipHereDocument(script, i);
+                if (after === undefined)
+                    return length;
+                i = after;
+                top.wordBoundary = true;
+                top.commandStart = true;
+                continue;
+            }
+            if (ch === '(') {
+                if (!top.commandStart || next === '(')
+                    return length;
+                top.wordBoundary = false;
+                top.commandStart = false;
+                push(')', true);
+                i++;
+                continue;
+            }
+            if (isWhitespace(ch) || ch === '\n' || ch === ';' || ch === '|' || ch === '&') {
+                top.wordBoundary = true;
+                if (ch === '\n' || ch === ';' || ch === '|' || ch === '&')
+                    top.commandStart = true;
+            }
+            else {
+                top.wordBoundary = ch === '<' || ch === '>';
+                top.commandStart = false;
+            }
         }
-        i += 1;
+        if ((ch === ')' || ch === '}') && ch === top.close)
+            pop();
+        i++;
     }
-    // An empty stack means the outermost region closed just before `i`; otherwise EOF arrived first.
     return stack.length === 0 ? i : length;
 }
+function isRegionWordBoundary(ch) {
+    return (ch === undefined || isWhitespace(ch) || ['\n', ';', '|', '&', '(', ')', '<', '>'].includes(ch));
+}
 /**
  * Whether a character is whitespace (spaces, tabs, CR, FF, VT).
  */