depvitals 0.2.0 → 0.4.0

package/dist/scanner/packageSpecifier.js

@@ -3,11 +3,13 @@
  *
  * This module classifies a single raw module specifier into a small set of categories without
  * executing code, reading the filesystem or consulting `node_modules`. It is a pure transformation
- * that sits between specifier extraction (Step 9) and dependency analysis (Step 12).
+ * that sits between specifier extraction (Step 9) and dependency analysis (Step 12). Separate internal
+ * helpers prepare bounded exact self-reference metadata without altering ordinary classification.
  *
  * It deliberately does not:
  * - decide whether a specifier is used, unused or missing (that belongs to the analyzer);
- * - resolve files on disk, `node_modules`, package `exports`, TS `paths` or bundler aliases;
+ * - resolve files on disk, `node_modules`, TS `paths` or bundler aliases;
+ * - implement general package `exports` resolution (conditions, patterns and fallbacks);
  * - validate a name against npm registry publication rules (names are compared case-sensitively);
  * - read `package.json#imports`, so `#` import aliases cannot be resolved here.
  *
@@ -95,4 +97,70 @@ function isMalformed(specifier) {
         specifier.includes('?') ||
         specifier.includes('%'));
 }
+/**
+ * Prepare the bounded self-reference subset from static JSON metadata, without I/O or mutation.
+ * Only a direct root string or an object consisting entirely of exact keys and safe string targets
+ * is supported. Mixed/conditional/pattern/array exports are deliberately not partially interpreted.
+ * This helper does not load metadata or change analyzer findings.
+ */
+export function createPackageSelfReferenceScope(metadata) {
+    const rawName = metadata['name'];
+    const name = typeof rawName === 'string' && !rawName.includes('*') && !hasControlCharacter(rawName)
+        ? rawName
+        : undefined;
+    const exports = metadata['exports'];
+    const exportedSubpaths = new Set();
+    if (typeof exports === 'string') {
+        if (isSafeExportPath(exports))
+            exportedSubpaths.add('.');
+    }
+    else if (typeof exports === 'object' && exports !== null && !Array.isArray(exports)) {
+        const entries = Object.entries(exports);
+        if (entries.every(([key, target]) => (key === '.' || isSafeExportPath(key)) &&
+            typeof target === 'string' &&
+            isSafeExportPath(target))) {
+            for (const [key] of entries)
+                exportedSubpaths.add(key);
+        }
+    }
+    return { name, exportedSubpaths };
+}
+/**
+ * Match the raw specifier before package-root normalization. A same-name declaration alone is not
+ * evidence of ownership, and builtin/unsupported references cannot become self references.
+ * Neither target existence nor runtime resolution is consulted.
+ */
+export function isPackageSelfReference(specifier, scope) {
+    if (scope?.name === undefined)
+        return false;
+    const key = specifier === scope.name
+        ? '.'
+        : specifier.startsWith(`${scope.name}/`)
+            ? `./${specifier.slice(scope.name.length + 1)}`
+            : undefined;
+    if (key === undefined || !scope.exportedSubpaths.has(key))
+        return false;
+    const classified = classifyPackageSpecifier(specifier);
+    return classified.kind === 'external' && classified.packageName === scope.name;
+}
+/** A deliberately literal subset: no normalization, URL decoding, patterns or path resolution. */
+function isSafeExportPath(value) {
+    if (!value.startsWith('./') || /[\\%*?:#]/.test(value) || hasControlCharacter(value))
+        return false;
+    return value
+        .slice(2)
+        .split('/')
+        .every((segment) => segment !== '' &&
+        segment !== '.' &&
+        segment !== '..' &&
+        segment.toLowerCase() !== 'node_modules');
+}
+function hasControlCharacter(value) {
+    for (const character of value) {
+        const code = character.charCodeAt(0);
+        if (code < 32 || code === 127)
+            return true;
+    }
+    return false;
+}
 //# sourceMappingURL=packageSpecifier.js.map

package/dist/scanner/packageSpecifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"packageSpecifier.js","sourceRoot":"","sources":["../../src/scanner/packageSpecifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAiBxC;;;;;GAKG;AACH,MAAM,cAAc,GAAG,2BAA2B,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,kGAAkG;IAClG,2FAA2F;IAC3F,mDAAmD;IACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,8FAA8F;IAC9F,0FAA0F;IAC1F,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,+CAA+C;IAC/C,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IAED,8FAA8F;IAC9F,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,2FAA2F;IAC3F,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED,4FAA4F;IAC5F,sEAAsE;IACtE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,mCAAmC;QACnC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,KAAK,IAAI,WAAW,EAAE,EAAE,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,SAAiB;IACpC,OAAO,CACL,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QACpB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CACxB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"packageSpecifier.js","sourceRoot":"","sources":["../../src/scanner/packageSpecifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAiBxC;;;;;GAKG;AACH,MAAM,cAAc,GAAG,2BAA2B,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,kGAAkG;IAClG,2FAA2F;IAC3F,mDAAmD;IACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,8FAA8F;IAC9F,0FAA0F;IAC1F,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,+CAA+C;IAC/C,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;IAED,8FAA8F;IAC9F,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,2FAA2F;IAC3F,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED,4FAA4F;IAC5F,sEAAsE;IACtE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,mCAAmC;QACnC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,KAAK,IAAI,WAAW,EAAE,EAAE,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,SAAiB;IACpC,OAAO,CACL,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QACpB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CACxB,CAAC;AACJ,CAAC;AAYD;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAA2C;IAE3C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,IAAI,GACR,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC;QACpF,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,gBAAgB,CAAC,OAAO,CAAC;YAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;SAAM,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,IACE,OAAO,CAAC,KAAK,CACX,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAChB,CAAC,GAAG,KAAK,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACtC,OAAO,MAAM,KAAK,QAAQ;YAC1B,gBAAgB,CAAC,MAAM,CAAC,CAC3B,EACD,CAAC;YACD,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO;gBAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,KAA4C;IAE5C,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,GAAG,GACP,SAAS,KAAK,KAAK,CAAC,IAAI;QACtB,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC;YACtC,CAAC,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE;YAC/C,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,MAAM,UAAU,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACvD,OAAO,UAAU,CAAC,IAAI,KAAK,UAAU,IAAI,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,CAAC;AACjF,CAAC;AAED,kGAAkG;AAClG,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,OAAO,KAAK;SACT,KAAK,CAAC,CAAC,CAAC;SACR,KAAK,CAAC,GAAG,CAAC;SACV,KAAK,CACJ,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,KAAK,EAAE;QACd,OAAO,KAAK,GAAG;QACf,OAAO,KAAK,IAAI;QAChB,OAAO,CAAC,WAAW,EAAE,KAAK,cAAc,CAC3C,CAAC;AACN,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,IAAI,GAAG,EAAE,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/scanner/projectManifest.d.ts

@@ -16,6 +16,7 @@
  * text is read as UTF-8 without any BOM handling: a manifest that `JSON.parse` rejects is reported
  * as invalid instead of being silently normalized.
  */
+import { type PackageSelfReferenceScope } from './packageSpecifier.js';
 /**
  * A dependency section: package name mapped to the version specifier declared for it.
  *
@@ -38,21 +39,34 @@ export type ProjectManifest = {
     name?: string;
     dependencies: DependencyMap;
     devDependencies: DependencyMap;
+    peerDependencies: DependencyMap;
+    optionalDependencies: DependencyMap;
     declaredDependencyNames: ReadonlySet<string>;
     /** `scripts` entries as static strings, never executed. */
     scripts: Readonly<Record<string, string>>;
     /** Root package type, used only to classify `.js` top-level await without executing config. */
     packageType: string | undefined;
+    /** Bounded exact exports ownership; never a dependency inventory. */
+    selfReference: PackageSelfReferenceScope;
+};
+/** Validated root inventory and its already-parsed JSON, scoped to one read. */
+export type ProjectManifestData = {
+    readonly manifest: ProjectManifest;
+    readonly raw: Readonly<Record<string, unknown>>;
 };
 /** The package-type hint declared by one package scope, or `undefined` when no manifest exists. */
 export type PackageTypeHint = {
     packageType: string | undefined;
 };
+/** One existing package scope, including nameless/no-exports scope boundaries. */
+export type PackageScopeMetadata = PackageTypeHint & {
+    selfReference: PackageSelfReferenceScope;
+};
 /**
  * Why a manifest could not be turned into a {@link ProjectManifest}.
  *
  * - `missing`: no `package.json` exists at the expected path.
- * - `unreadable`: the file exists but could not be read (permissions, not a directory, ...).
+ * - `unreadable`: the entry is linked/non-regular, or a present file could not be read.
  * - `invalid-json`: the file content is not valid JSON.
  * - `invalid-shape`: the JSON is valid but its structure is not what the model requires.
  */
@@ -73,14 +87,25 @@ export declare class ProjectManifestError extends Error {
  *
  * @throws {ProjectManifestError} when the manifest is missing, unreadable, invalid JSON, or has an
  * unexpected structure.
+ * @throws {SourceFilesError} when the selected root is linked or is not a directory.
  */
 export declare function loadProjectManifest(projectRoot: string): Promise<ProjectManifest>;
+/** Read and validate root metadata once while retaining raw detector fields. */
+export declare function loadProjectManifestData(projectRoot: string): Promise<ProjectManifestData>;
 /**
  * Read only the static `type` hint from the manifest in `directory`.
  *
- * Source-mode resolution calls this for nested package scopes. A missing manifest means that the
+ * The combined scope reader below supplies analysis with ownership too. A missing manifest means the
  * parent scope remains applicable; an existing manifest with no string `type` starts a new scope
- * with script/CommonJS behavior.
+ * whose `.js` files are ambiguous rather than inheriting the parent's explicit module mode.
  */
 export declare function loadPackageTypeHint(directory: string): Promise<PackageTypeHint | undefined>;
+/** Read module mode and bounded ownership together, with the same mandatory manifest guard. */
+export declare function loadPackageScope(directory: string): Promise<PackageScopeMetadata | undefined>;
+/**
+ * Read mandatory manifest text only from a non-linked regular file. Only absence at lstat means
+ * no scope; a present entry that cannot be read (including disappearance after lstat) is an error.
+ * This checks stable filesystem entries, not adversarial replacement between calls.
+ */
+export declare function readManifestText(packageJsonPath: string): Promise<string>;
 //# sourceMappingURL=projectManifest.d.ts.map

package/dist/scanner/projectManifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projectManifest.d.ts","sourceRoot":"","sources":["../../src/scanner/projectManifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,aAAa,CAAC;IAC5B,eAAe,EAAE,aAAa,CAAC;IAC/B,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7C,2DAA2D;IAC3D,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,+FAA+F;IAC/F,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,CAAC;AAEF,mGAAmG;AACnG,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,YAAY,GAAG,cAAc,GAAG,eAAe,CAAC;AAInG;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;gBAE5B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,OAAO;CAK7E;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAYvF;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAiCjG"}
+{"version":3,"file":"projectManifest.d.ts","sourceRoot":"","sources":["../../src/scanner/projectManifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,aAAa,CAAC;IAC5B,eAAe,EAAE,aAAa,CAAC;IAC/B,gBAAgB,EAAE,aAAa,CAAC;IAChC,oBAAoB,EAAE,aAAa,CAAC;IACpC,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7C,2DAA2D;IAC3D,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,+FAA+F;IAC/F,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,qEAAqE;IACrE,aAAa,EAAE,yBAAyB,CAAC;CAC1C,CAAC;AAEF,gFAAgF;AAChF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjD,CAAC;AAEF,mGAAmG;AACnG,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,CAAC;AAEF,kFAAkF;AAClF,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG;IACnD,aAAa,EAAE,yBAAyB,CAAC;CAC1C,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,YAAY,GAAG,cAAc,GAAG,eAAe,CAAC;AAInG;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;gBAE5B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,OAAO;CAK7E;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAEvF;AAED,gFAAgF;AAChF,wBAAsB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAiB/F;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAGjG;AAED,+FAA+F;AAC/F,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CA6B3C;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB/E"}

package/dist/scanner/projectManifest.js

@@ -16,8 +16,10 @@
  * text is read as UTF-8 without any BOM handling: a manifest that `JSON.parse` rejects is reported
  * as invalid instead of being silently normalized.
  */
-import { readFile } from 'node:fs/promises';
+import { lstat, readFile } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
+import { assertReadableRoot, SourceFilesError } from './sourceFiles.js';
+import { createPackageSelfReferenceScope, } from './packageSpecifier.js';
 const MANIFEST_FILENAME = 'package.json';
 /**
  * Operational error for manifest loading. The `code` lets callers (the CLI in a later step) render
@@ -39,37 +41,51 @@ export class ProjectManifestError extends Error {
  *
  * @throws {ProjectManifestError} when the manifest is missing, unreadable, invalid JSON, or has an
  * unexpected structure.
+ * @throws {SourceFilesError} when the selected root is linked or is not a directory.
  */
 export async function loadProjectManifest(projectRoot) {
+    return (await loadProjectManifestData(projectRoot)).manifest;
+}
+/** Read and validate root metadata once while retaining raw detector fields. */
+export async function loadProjectManifestData(projectRoot) {
     const root = resolve(projectRoot);
     const packageJsonPath = join(root, MANIFEST_FILENAME);
-    let text;
     try {
-        text = await readFile(packageJsonPath, 'utf8');
+        await assertReadableRoot(root);
     }
     catch (error) {
-        throw toReadError(packageJsonPath, error);
+        // Preserve manifest-loader diagnostics for missing/unreadable roots, but reject linked roots
+        // with the same typed root error as source discovery before any target input is consulted.
+        if (error instanceof SourceFilesError && error.code !== 'not-a-directory') {
+            throw toReadError(packageJsonPath, error.cause ?? error);
+        }
+        throw error;
     }
+    const text = await readManifestText(packageJsonPath);
     return parseManifest(root, packageJsonPath, text);
 }
 /**
  * Read only the static `type` hint from the manifest in `directory`.
  *
- * Source-mode resolution calls this for nested package scopes. A missing manifest means that the
+ * The combined scope reader below supplies analysis with ownership too. A missing manifest means the
  * parent scope remains applicable; an existing manifest with no string `type` starts a new scope
- * with script/CommonJS behavior.
+ * whose `.js` files are ambiguous rather than inheriting the parent's explicit module mode.
  */
 export async function loadPackageTypeHint(directory) {
+    const scope = await loadPackageScope(directory);
+    return scope === undefined ? undefined : { packageType: scope.packageType };
+}
+/** Read module mode and bounded ownership together, with the same mandatory manifest guard. */
+export async function loadPackageScope(directory) {
     const packageJsonPath = join(resolve(directory), MANIFEST_FILENAME);
     let text;
     try {
-        text = await readFile(packageJsonPath, 'utf8');
+        text = await readManifestText(packageJsonPath);
     }
     catch (error) {
-        if (isNotFoundError(error)) {
+        if (error instanceof ProjectManifestError && error.code === 'missing')
             return undefined;
-        }
-        throw new ProjectManifestError(`Could not read ${MANIFEST_FILENAME} at ${packageJsonPath}`, 'unreadable', error);
+        throw error;
     }
     let parsed;
     try {
@@ -81,11 +97,37 @@ export async function loadPackageTypeHint(directory) {
     if (!isPlainRecord(parsed)) {
         throw new ProjectManifestError(`${packageJsonPath} must contain a JSON object`, 'invalid-shape');
     }
-    return { packageType: readOptionalString(parsed, 'type') };
+    return {
+        packageType: readOptionalString(parsed, 'type'),
+        selfReference: createPackageSelfReferenceScope(parsed),
+    };
+}
+/**
+ * Read mandatory manifest text only from a non-linked regular file. Only absence at lstat means
+ * no scope; a present entry that cannot be read (including disappearance after lstat) is an error.
+ * This checks stable filesystem entries, not adversarial replacement between calls.
+ */
+export async function readManifestText(packageJsonPath) {
+    let info;
+    try {
+        info = await lstat(packageJsonPath);
+    }
+    catch (error) {
+        throw toReadError(packageJsonPath, error);
+    }
+    if (!info.isFile()) {
+        throw new ProjectManifestError(`${packageJsonPath} must be a regular file; symlinks and non-regular entries are not read`, 'unreadable');
+    }
+    try {
+        return await readFile(packageJsonPath, 'utf8');
+    }
+    catch (error) {
+        throw new ProjectManifestError(`Could not read ${MANIFEST_FILENAME} at ${packageJsonPath}`, 'unreadable', error);
+    }
 }
 /**
  * Classify a filesystem failure: a missing manifest is expected and reported separately from any
- * other I/O problem. A root that turns out to be a file surfaces as `ENOTDIR` and stays unreadable.
+ * other I/O problem. Missing nested scopes may inherit only when the entry was absent at lstat.
  */
 function toReadError(packageJsonPath, error) {
     if (isNotFoundError(error)) {
@@ -125,6 +167,8 @@ function parseManifest(root, packageJsonPath, text) {
         packageJsonPath,
         dependencies,
         devDependencies,
+        peerDependencies,
+        optionalDependencies,
         declaredDependencyNames: declaredNames([
             dependencies,
             devDependencies,
@@ -133,8 +177,9 @@ function parseManifest(root, packageJsonPath, text) {
         ]),
         scripts,
         packageType,
+        selfReference: createPackageSelfReferenceScope(parsed),
     };
-    return name === undefined ? manifest : { ...manifest, name };
+    return { manifest: name === undefined ? manifest : { ...manifest, name }, raw: parsed };
 }
 function readOptionalString(manifest, key) {
     const value = manifest[key];

package/dist/scanner/projectManifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"projectManifest.js","sourceRoot":"","sources":["../../src/scanner/projectManifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+C1C,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,IAAI,CAA2B;IAExC,YAAY,OAAe,EAAE,IAA8B,EAAE,KAAe;QAC1E,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,WAAmB;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAEtD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAEpE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,oBAAoB,CAC5B,kBAAkB,iBAAiB,OAAO,eAAe,EAAE,EAC3D,YAAY,EACZ,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAAC,GAAG,eAAe,oBAAoB,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,6BAA6B,EAC/C,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,eAAuB,EAAE,KAAc;IAC1D,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,oBAAoB,CAC7B,MAAM,iBAAiB,aAAa,eAAe,EAAE,EACrD,SAAS,EACT,KAAK,CACN,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,oBAAoB,CAC7B,kBAAkB,iBAAiB,OAAO,eAAe,EAAE,EAC3D,YAAY,EACZ,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,eAAuB,EAAE,IAAY;IACxE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAAC,GAAG,eAAe,oBAAoB,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,6BAA6B,EAC/C,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IAC/E,MAAM,eAAe,GAAG,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC;IACrF,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;IAC/F,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,EAAE,eAAe,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAoB;QAChC,IAAI;QACJ,eAAe;QACf,YAAY;QACZ,eAAe;QACf,uBAAuB,EAAE,aAAa,CAAC;YACrC,YAAY;YACZ,eAAe;YACf,oBAAoB;YACpB,gBAAgB;SACjB,CAAC;QACF,OAAO;QACP,WAAW;KACZ,CAAC;IAEF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAiC,EAAE,GAAW;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,QAAiC,EAAE,eAAuB;IAC1E,MAAM,KAAK,GAAY,QAAQ,CAAC,MAAM,CAAC,CAAC;IAExC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,6CAA6C,EAC/D,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,QAAiC,EACjC,OAAe,EACf,eAAuB;IAEvB,MAAM,KAAK,GAAY,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,WAAW,OAAO,sCAAsC,EAC1E,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,WAAW,OAAO,2CAA2C,GAAG,mBAAmB,EACrG,eAAe,CAChB,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE/C,0FAA0F;IAC1F,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,QAAkC;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,sFAAsF;IACtF,OAAO,IAAI,GAAG,CAAS,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"projectManifest.js","sourceRoot":"","sources":["../../src/scanner/projectManifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,+BAA+B,GAEhC,MAAM,uBAAuB,CAAC;AA8D/B,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,IAAI,CAA2B;IAExC,YAAY,OAAe,EAAE,IAA8B,EAAE,KAAe;QAC1E,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,WAAmB;IAC3D,OAAO,CAAC,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/D,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,WAAmB;IAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6FAA6F;QAC7F,2FAA2F;QAC3F,IAAI,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC1E,MAAM,WAAW,CAAC,eAAe,EAAE,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAErD,OAAO,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;AAC9E,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAiB;IAEjB,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAEpE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,oBAAoB,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxF,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAAC,GAAG,eAAe,oBAAoB,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,6BAA6B,EAC/C,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,WAAW,EAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC;QAC/C,aAAa,EAAE,+BAA+B,CAAC,MAAM,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,eAAuB;IAC5D,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,wEAAwE,EAC1F,YAAY,CACb,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAC5B,kBAAkB,iBAAiB,OAAO,eAAe,EAAE,EAC3D,YAAY,EACZ,KAAK,CACN,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,eAAuB,EAAE,KAAc;IAC1D,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,oBAAoB,CAC7B,MAAM,iBAAiB,aAAa,eAAe,EAAE,EACrD,SAAS,EACT,KAAK,CACN,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,oBAAoB,CAC7B,kBAAkB,iBAAiB,OAAO,eAAe,EAAE,EAC3D,YAAY,EACZ,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,eAAuB,EAAE,IAAY;IACxE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAAC,GAAG,eAAe,oBAAoB,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,6BAA6B,EAC/C,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IAC/E,MAAM,eAAe,GAAG,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC;IACrF,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,EAAE,eAAe,CAAC,CAAC;IAC/F,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,EAAE,eAAe,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAoB;QAChC,IAAI;QACJ,eAAe;QACf,YAAY;QACZ,eAAe;QACf,gBAAgB;QAChB,oBAAoB;QACpB,uBAAuB,EAAE,aAAa,CAAC;YACrC,YAAY;YACZ,eAAe;YACf,oBAAoB;YACpB,gBAAgB;SACjB,CAAC;QACF,OAAO;QACP,WAAW;QACX,aAAa,EAAE,+BAA+B,CAAC,MAAM,CAAC;KACvD,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAiC,EAAE,GAAW;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,QAAiC,EAAE,eAAuB;IAC1E,MAAM,KAAK,GAAY,QAAQ,CAAC,MAAM,CAAC,CAAC;IAExC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,6CAA6C,EAC/D,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,QAAiC,EACjC,OAAe,EACf,eAAuB;IAEvB,MAAM,KAAK,GAAY,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,WAAW,OAAO,sCAAsC,EAC1E,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,oBAAoB,CAC5B,GAAG,eAAe,WAAW,OAAO,2CAA2C,GAAG,mBAAmB,EACrG,eAAe,CAChB,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE/C,0FAA0F;IAC1F,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,QAAkC;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,sFAAsF;IACtF,OAAO,IAAI,GAAG,CAAS,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/scanner/scriptUsage.d.ts

@@ -29,6 +29,7 @@
  *   `bin` fields and it is not framework support - any other executable keeps exact-name matching;
  * - the five documented package-runner forms count (`npx`, `npm exec`, `pnpm exec`, `pnpm dlx`,
  *   `yarn dlx`) with the package in its immediate position;
+ * - the supported option prefix of exact `node` commands can credit explicit preload modules;
  * - leading POSIX environment assignments (`NODE_ENV=test`, `FOO=1 BAR=2`) are skipped;
  * - quoted tokens keep their content, so separators and text inside quotes are not misread.
  *
@@ -38,8 +39,10 @@
  * that is still open at the end of the script. Each such region is consumed as an opaque block, so a
  * separator inside it never delimits the surrounding script. An invalidated segment yields no
  * evidence at all, while the neighbouring segments delimited by real supported separators are still
- * analyzed normally.
+ * analyzed normally. Here-document payloads stay opaque; scanning resumes only after a proven
+ * literal closing delimiter. Unknown headers discard the unproven remainder.
  */
+import { type ScriptEvidence } from '../core/evidence.js';
 /**
  * Recognize the declared dependencies that `package.json` scripts clearly reference.
  *
@@ -57,4 +60,15 @@
  * @param declaredPackageNames - the declared dependency names that may be suppressed as used.
  */
 export declare function findPackageScriptUsage(scripts: Readonly<Record<string, string>>, declaredPackageNames: ReadonlySet<string>): ReadonlySet<string>;
+/** Internal package owner plus the exact script evidence that belongs to it. */
+export type PackageScriptOccurrence = {
+    readonly packageName: string;
+    readonly evidence: ScriptEvidence;
+};
+/**
+ * Authoritative script collector. Ordinals enumerate existing candidate events over the entire
+ * script, before the declaration gate. Exact key/ordinal pairs already distinguish occurrences;
+ * repeated selectors and independent script keys must not be collapsed into one fact.
+ */
+export declare function collectPackageScriptUsage(scripts: Readonly<Record<string, string>>, declaredPackageNames: ReadonlySet<string>): readonly PackageScriptOccurrence[];
 //# sourceMappingURL=scriptUsage.d.ts.map

package/dist/scanner/scriptUsage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scriptUsage.d.ts","sourceRoot":"","sources":["../../src/scanner/scriptUsage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AA6TH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,GACxC,WAAW,CAAC,MAAM,CAAC,CAYrB"}
+{"version":3,"file":"scriptUsage.d.ts","sourceRoot":"","sources":["../../src/scanner/scriptUsage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,qBAAqB,CAAC;AA8T7B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,GACxC,WAAW,CAAC,MAAM,CAAC,CAIrB;AAED,gFAAgF;AAChF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;CACnC,CAAC;AAQF;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,GACxC,SAAS,uBAAuB,EAAE,CA2BpC"}