projscan 0.11.0 → 0.14.0

package/README.md

@@ -20,7 +20,7 @@
 
 AI coding agents are becoming the primary interface to code. Today, when you ask your agent *"which files implement auth?"* or *"what breaks if I bump React from 18 to 19?"* - it either guesses from names, or it shells out to grep and reads raw output not built for it.
 
-**projscan is the first code-intelligence tool built for agents, not for humans.** Your agent gets a fast, AST-accurate, context-budget-aware view of your codebase through 17 structured MCP tools. It can query the import graph, find symbol definitions, preview upgrades, rank hotspots, diff structural changes between refs, and surface coupling/cycle hotspots - without loading the file tree into its context.
+**projscan is the first code-intelligence tool built for agents, not for humans.** Your agent gets a fast, AST-accurate, context-budget-aware view of your codebase through 19 structured MCP tools. It can query the import graph, find symbol definitions, preview upgrades, rank hotspots, diff structural changes between refs, surface coupling/cycle hotspots, get a one-call PR review, and request structured fix-action prompts for any open issue - without loading the file tree into its context.
 
 Humans get the same thing through the CLI.
 
@@ -190,7 +190,7 @@ This outputs a [shields.io](https://shields.io) badge URL and markdown snippet y
 
 ## What It Detects
 
-**Languages**: TypeScript, JavaScript, Python, and Go (full AST analysis for all four), plus file-level detection for Rust, Java, Ruby, C/C++, PHP, Swift, Kotlin, and 20+ more.
+**Languages**: TypeScript, JavaScript, Python, Go, Java, and Ruby (full AST analysis for all six), plus file-level detection for Rust, C/C++, PHP, Swift, Kotlin, and 20+ more.
 
 **Frameworks**: React, Next.js, Vue, Nuxt, Svelte, Angular, Express, Fastify, NestJS, Vite, Tailwind CSS, Prisma, and more
 
@@ -206,35 +206,57 @@ Python repos now get the same treatment JS/TS has had since 0.6:
 
 `projscan_upgrade` remains Node-only for now - a Python equivalent (reading pip / poetry metadata) is on the roadmap.
 
-### Bundle (0.11)
+### Go (0.11)
 
-0.11.0 is a multi-theme bundle. Five releases of work shipped under one version:
+Go flows through the same pipeline as JS/TS and Python:
 
-- **Signal Quality (was 0.11)** - the hotspot risk score now uses AST-derived **cyclomatic complexity** instead of a line-count proxy. Per-file CC is exposed via `projscan_file` and the new `projscan_coupling` tool. Coupling metrics (fan-in / fan-out / instability) and **circular-import detection** (Tarjan SCC) ship as a first-class `projscan coupling` command and MCP tool.
-- **PR Native (was 0.12)** - new `projscan_pr_diff` tool returns the **structural** diff between two refs: exports added/removed, imports added/removed, call sites added/removed, ΔCC, Δfan-in. Stands up a temporary git worktree at the base ref to get a clean second graph. What an agent reviewing a PR actually wants to know.
-- **Monorepo (was 0.13)** - workspace detection for npm/yarn workspaces, pnpm-workspace.yaml, and Nx/Turbo/Lerna fallback. New `projscan workspaces` command lists every package; `--package <name>` (and the `package` MCP arg) scope `hotspots` and `coupling` to a single workspace.
-- **Observability (was 0.14)** - **opt-in**, privacy-preserving telemetry. Records only tool name, duration, success, version, timestamp; never source content, paths, or arguments. Off by default; enable via `.projscanrc` `telemetry.enabled` or `PROJSCAN_TELEMETRY=1`. Sink is a local JSONL file you control. New `projscan_telemetry` tool surfaces effective state.
-- **Second Language (was 0.15)** - **Go** via tree-sitter-go. Go files now flow through the same graph / hotspot / coupling / pr-diff pipeline as JS/TS and Python. `go.mod` parsed for module-path resolution; capitalization rule applied for export visibility.
+- **AST-accurate import graph** via tree-sitter-go. Single-line and parenthesized import blocks, aliased imports, dot-imports.
+- **Capitalization-rule export visibility** - uppercase identifiers are public, lowercase are private. Captures `func`, method, `var`, `const`, `type` (struct/interface).
+- **`go.mod` module-path resolution** - imports prefixed with the module path resolve into the repo; stdlib and third-party are external.
+- **Cyclomatic complexity** counted from `if`, `for`, `switch` cases, select communication cases, `&&`/`||`. Default cases and `defer`/`go` don't count.
 
-Cache version bumped 2 → 3 (CC stored per file). Existing v2 caches are discarded on first 0.11 run and rebuilt automatically.
+### Coupling and cycles (0.11)
 
-**Issues**:
-- Missing linting (ESLint) and formatting (Prettier) configuration
-- Missing test framework
-- Missing `.editorconfig`
-- Large utility directories (architecture smell)
-- Excessive, deprecated, or wildcard-versioned dependencies
-- Missing lockfile
-- Committed `.env` files and private keys (security)
-- Hardcoded secrets - AWS keys, GitHub tokens, Slack tokens, generic passwords (security)
-- Missing `.env` in `.gitignore` (security)
+`projscan coupling` (CLI + MCP tool) reports per-file fan-in / fan-out / instability (Bob Martin's I = Ce / (Ca + Ce)) and detects circular imports via Tarjan SCC. Cross-package edges are flagged when running on a monorepo.
+
+### PR-aware structural diff (0.11)
+
+`projscan pr-diff` returns the structural diff between two refs: exports added/removed/renamed, imports added/removed, call sites added/removed, ΔCC, Δfan-in. Spins up a temporary git worktree at the base ref to build a clean second graph. Renames are detected via similarity scoring (max of normalized Levenshtein and shared-affix fraction, threshold 0.5).
+
+### Monorepo support (0.11)
+
+Detects npm/yarn workspaces, `pnpm-workspace.yaml`, Lerna, modern Nx (`nx.json#workspaceLayout` + `project.json` scan), legacy Nx (`workspace.json#projects`), and a `packages/*` + `apps/*` + `libs/*` fallback. `projscan workspaces` lists every package; `--package <name>` (or the `package` MCP arg) scopes most commands to a single workspace.
+
+Cache version bumped 2 → 3 in 0.11 (CC stored per file). Existing v2 caches are discarded on first run and rebuilt automatically.
 
 ## Performance
 
-- **5,000 files** analyzed in under 1.5 seconds
-- **20,000 files** analyzed in under 3 seconds
+Reference numbers from `npm run bench` (projscan repo + synthetic) on an Apple M3 Pro running Node 25:
+
+| Repo | Files | analyze | doctor | hotspots | coupling | search |
+|------|-------|---------|--------|----------|----------|--------|
+| projscan itself | ~120 | 415–578 ms | 404–498 ms | 462–637 ms | 164–326 ms | 234–393 ms |
+| Synthetic medium | 500 | 244–273 ms | 248–262 ms | 264–293 ms | 165–208 ms | 182–225 ms |
+
+For real-world numbers against larger codebases, `npm run bench:references` shallow-clones TypeScript, Django, and kubernetes/client-go into `.bench-cache/` (gitignored) and runs the same suite. First run is network-bound; later runs reuse the cache. Restrict to one target with `-- --only ts|django|k8s-client-go`.
+
+Cold-cache and warm-cache times shown side by side. Run `npm run bench` against your own machine to recalibrate.
+
 - **Zero network requests** - everything runs locally
-- **9 runtime dependencies** - still minimal (the three tree-sitter packages bring ~850 KB of vendored wasm: web-tree-sitter ~190 KB, tree-sitter-python ~450 KB, tree-sitter-go ~210 KB)
+- **11 runtime dependencies** - still minimal (the five tree-sitter grammars bring ~3.3 MB of vendored wasm: web-tree-sitter ~190 KB, tree-sitter-python ~450 KB, tree-sitter-go ~210 KB, tree-sitter-java ~405 KB, tree-sitter-ruby ~2.0 MB)
+
+## Optional features
+
+projscan keeps the install slim by default. One feature is gated behind an optional peer dependency:
+
+- **Semantic search** uses local embeddings via `@xenova/transformers` (~25 MB quantized model, downloads on first use, then cached). Without it, `projscan search` falls back to BM25 lexical search and prints a one-line tip pointing here. Install when you want it:
+
+  ```bash
+  npm install @xenova/transformers
+  projscan search "cache invalidation" --semantic
+  ```
+
+  See [AI Agent Integration → Semantic search](#semantic-search-090-opt-in) for details.
 
 ## CI/CD Integration
 
@@ -441,32 +463,34 @@ claude mcp add projscan -- npx projscan mcp
 - *"What breaks if I bump chalk to 6?"* → `projscan_upgrade { package: "chalk" }`
 - *"Where should I refactor first?"* → `projscan_hotspots`
 
-### The 17 MCP tools
+### The 19 MCP tools
 
-**Structural (0.6.0 / 0.11 — agent-native):**
+**Structural (0.6.0 / 0.11 / 0.13 / 0.14 - agent-native):**
 - **`projscan_graph`** - query the AST-based code graph. Directions: `imports`, `exports`, `importers`, `symbol_defs`, `package_importers`. Millisecond responses on a warm cache.
 - **`projscan_search`** - fast search across `symbols` (exported names), `files` (path substring), or `content` (source substring with line + excerpt). Replaces the temptation to shell out to grep.
 - **`projscan_coupling`** *(0.11)* - per-file fan-in / fan-out / instability + circular-import cycles (Tarjan SCC). Filter by `direction: cycles_only | high_fan_in | high_fan_out`.
 - **`projscan_pr_diff`** *(0.11)* - structural diff between two git refs. Returns added/removed/modified files with explicit lists of exports, imports, and call sites that changed, plus ΔCC and Δfan-in.
+- **`projscan_review`** *(0.13)* - one-call PR review. Composes `pr_diff` + per-changed-file risk + new/expanded import cycles + risky function additions + dependency changes + a verdict (`ok` / `review` / `block`).
+- **`projscan_fix_suggest`** *(0.14)* - structured action prompt for any open issue: headline, why it matters, where, one-paragraph instruction, optional suggested test. Closes the diagnose → fix loop.
+- **`projscan_explain_issue`** *(0.14)* - deep dive on one issue: code excerpt, related issues in the same file, similar past commits via `git log --grep`, plus the structured FixSuggestion.
 
 **Analysis:**
 - `projscan_analyze` - full project report
-- `projscan_doctor` - health score + issues
-- `projscan_hotspots` - risk-ranked files (churn × **AST cyclomatic complexity** × issues × ownership × coverage; falls back to LOC for non-AST languages)
-- `projscan_file` - per-file risk + ownership + related issues + CC + fan-in/fan-out
+- `projscan_doctor` - health score + issues (now includes `cycle-detected-N` for circular imports as of 0.13)
+- `projscan_hotspots` - risk-ranked files (churn × **AST cyclomatic complexity** × issues × ownership × coverage; falls back to LOC for non-AST languages). Pass `view: "functions"` *(0.13)* for top-N risky individual functions.
+- `projscan_file` - per-file risk + ownership + related issues + CC + fan-in/fan-out + per-function CC table *(0.13)*
 - `projscan_explain` - per-file purpose, imports, exports, smells
 - `projscan_structure` - directory tree
 - `projscan_coverage` - scariest untested files (coverage × hotspots)
 
 **Dependencies:**
-- `projscan_dependencies` - declared deps, risks
-- `projscan_outdated` - declared-vs-installed drift (offline)
-- `projscan_audit` - normalized `npm audit`
+- `projscan_dependencies` - declared deps, risks. In a monorepo: aggregated totals + `byWorkspace` breakdown; `package` arg scopes to one *(0.13)*.
+- `projscan_outdated` - declared-vs-installed drift (offline). Per-package `byWorkspace`; `package` arg.
+- `projscan_audit` - normalized `npm audit`. `package` arg scopes findings to one workspace's direct deps *(0.13)*.
 - `projscan_upgrade` - upgrade preview (CHANGELOG + importers, offline)
 
-**Workspace + observability (0.11):**
+**Workspace (0.11):**
 - `projscan_workspaces` - list monorepo packages (npm/yarn/pnpm/Nx/Turbo/Lerna). Use the `name` as the `package` arg on `projscan_hotspots` / `projscan_coupling` to scope.
-- `projscan_telemetry` - inspect opt-in telemetry state (enabled?, sink path, env override).
 
 ### Context-window budgeting
 

package/dist/analyzers/crossPackageImportCheck.d.ts

@@ -0,0 +1,13 @@
+import type { FileEntry, Issue } from '../types.js';
+/**
+ * Cross-package import policy (0.14.0). Walks the cross-package edges
+ * detected by `computeCoupling` and checks each against the user-configured
+ * `monorepo.importPolicy` block in `.projscanrc`. Emits one
+ * `cross-package-violation-N` issue per violating edge (capped at 50 to
+ * keep the doctor output bounded on large monorepos).
+ *
+ * Off by default: the analyzer is a no-op when no `monorepo.importPolicy`
+ * entries are configured or when the repo isn't a monorepo. Adding a
+ * single rule turns it on for the matching `from` package.
+ */
+export declare function check(rootPath: string, files: FileEntry[]): Promise<Issue[]>;

package/dist/analyzers/crossPackageImportCheck.js

@@ -0,0 +1,136 @@
+import path from 'node:path';
+import { buildCodeGraph } from '../core/codeGraph.js';
+import { loadCachedGraph, saveCachedGraph } from '../core/indexCache.js';
+import { computeCoupling } from '../core/couplingAnalyzer.js';
+import { detectWorkspaces } from '../core/monorepo.js';
+import { loadConfig } from '../utils/config.js';
+const MAX_VIOLATIONS_REPORTED = 50;
+/**
+ * Cross-package import policy (0.14.0). Walks the cross-package edges
+ * detected by `computeCoupling` and checks each against the user-configured
+ * `monorepo.importPolicy` block in `.projscanrc`. Emits one
+ * `cross-package-violation-N` issue per violating edge (capped at 50 to
+ * keep the doctor output bounded on large monorepos).
+ *
+ * Off by default: the analyzer is a no-op when no `monorepo.importPolicy`
+ * entries are configured or when the repo isn't a monorepo. Adding a
+ * single rule turns it on for the matching `from` package.
+ */
+export async function check(rootPath, files) {
+    const { config } = await loadConfig(rootPath);
+    const rules = config.monorepo?.importPolicy ?? [];
+    if (rules.length === 0)
+        return [];
+    const ws = await detectWorkspaces(rootPath);
+    const realWorkspaces = ws.packages.filter((p) => !p.isRoot);
+    if (ws.kind === 'none' || realWorkspaces.length < 2)
+        return [];
+    // Index rules by `from` for O(1) lookup.
+    const rulesByPackage = new Map();
+    for (const r of rules)
+        rulesByPackage.set(r.from, r);
+    const cached = await loadCachedGraph(rootPath);
+    let graph;
+    try {
+        graph = await buildCodeGraph(rootPath, files, cached);
+    }
+    catch {
+        return [];
+    }
+    await saveCachedGraph(rootPath, graph).catch(() => undefined);
+    const coupling = computeCoupling(graph, ws);
+    if (coupling.crossPackageEdges.length === 0)
+        return [];
+    const issues = [];
+    let counter = 0;
+    for (const edge of coupling.crossPackageEdges) {
+        if (issues.length >= MAX_VIOLATIONS_REPORTED)
+            break;
+        const rule = rulesByPackage.get(edge.from.package);
+        if (!rule)
+            continue;
+        const verdict = evaluateEdge(rule, edge.to.package);
+        if (verdict !== 'deny')
+            continue;
+        counter++;
+        // Try to find the actual import line. The graph file's imports include
+        // resolved files; we can match by source string suffix to recover the line.
+        const importingFile = graph.files.get(edge.from.file);
+        const lineHint = importingFile?.imports.find((i) => 
+        // The resolved target's basename usually appears in the source spec;
+        // this is best-effort. If we can't pin a line, fall back to file only.
+        edge.to.file.includes(path.basename(i.source).replace(/\.[a-z]+$/, '')));
+        const location = lineHint?.line
+            ? { file: edge.from.file, line: lineHint.line }
+            : { file: edge.from.file };
+        issues.push({
+            id: `cross-package-violation-${counter}`,
+            title: `Disallowed import from "${edge.from.package}" to "${edge.to.package}"`,
+            description: `${edge.from.file} imports from package "${edge.to.package}" but the .projscanrc importPolicy rule for "${edge.from.package}" forbids it. ` +
+                'Replace with the package\'s public entry or update the importPolicy.',
+            severity: 'warning',
+            category: 'architecture',
+            fixAvailable: false,
+            locations: [location],
+        });
+    }
+    if (coupling.crossPackageEdges.length > MAX_VIOLATIONS_REPORTED && issues.length === MAX_VIOLATIONS_REPORTED) {
+        issues.push({
+            id: 'cross-package-violation-overflow',
+            title: 'Additional cross-package policy violations not reported',
+            description: `Doctor caps violation reporting at ${MAX_VIOLATIONS_REPORTED}. Run \`projscan coupling\` for the full edge list.`,
+            severity: 'info',
+            category: 'architecture',
+            fixAvailable: false,
+        });
+    }
+    return issues;
+}
+/**
+ * Decide whether an edge from a rule's `from` package to `targetPackage`
+ * is allowed or denied. Logic:
+ *   - If `allow` is set and matches → 'allow' (short-circuits).
+ *   - If `deny` is set and matches → 'deny'.
+ *   - If `allow` is set and doesn't match → 'deny' (allow-list semantics).
+ *   - Otherwise → 'allow' (no policy hit).
+ */
+function evaluateEdge(rule, targetPackage) {
+    if (rule.allow && rule.allow.length > 0) {
+        if (matchesAny(targetPackage, rule.allow))
+            return 'allow';
+        // allow-list miss is a deny.
+        return 'deny';
+    }
+    if (rule.deny && rule.deny.length > 0) {
+        if (matchesAny(targetPackage, rule.deny))
+            return 'deny';
+    }
+    return 'allow';
+}
+function matchesAny(name, patterns) {
+    for (const p of patterns) {
+        if (matchesGlob(name, p))
+            return true;
+    }
+    return false;
+}
+function matchesGlob(name, pattern) {
+    if (pattern === '*')
+        return true;
+    if (pattern === name)
+        return true;
+    // Simple suffix glob: `pkg/*`
+    if (pattern.endsWith('/*')) {
+        const prefix = pattern.slice(0, -2);
+        if (name.startsWith(prefix + '/'))
+            return true;
+    }
+    // Simple prefix glob: `*/sub`
+    if (pattern.startsWith('*/')) {
+        const suffix = pattern.slice(2);
+        if (name.endsWith('/' + suffix))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=crossPackageImportCheck.js.map

package/dist/analyzers/crossPackageImportCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crossPackageImportCheck.js","sourceRoot":"","sources":["../../src/analyzers/crossPackageImportCheck.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,QAAgB,EAAE,KAAkB;IAC9D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAE/D,yCAAyC;IACzC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE9D,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvD,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,IAAI,uBAAuB;YAAE,MAAM;QACpD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,MAAM;YAAE,SAAS;QAEjC,OAAO,EAAE,CAAC;QACV,uEAAuE;QACvE,4EAA4E;QAC5E,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACjD,qEAAqE;QACrE,uEAAuE;QACvE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CACxE,CAAC;QACF,MAAM,QAAQ,GAAG,QAAQ,EAAE,IAAI;YAC7B,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;YAC/C,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAE7B,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,2BAA2B,OAAO,EAAE;YACxC,KAAK,EAAE,2BAA2B,IAAI,CAAC,IAAI,CAAC,OAAO,SAAS,IAAI,CAAC,EAAE,CAAC,OAAO,GAAG;YAC9E,WAAW,EACT,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,0BAA0B,IAAI,CAAC,EAAE,CAAC,OAAO,gDAAgD,IAAI,CAAC,IAAI,CAAC,OAAO,gBAAgB;gBAC3I,sEAAsE;YACxE,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,CAAC,QAAQ,CAAC;SACtB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,iBAAiB,CAAC,MAAM,GAAG,uBAAuB,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;QAC7G,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,kCAAkC;YACtC,KAAK,EAAE,yDAAyD;YAChE,WAAW,EAAE,sCAAsC,uBAAuB,qDAAqD;YAC/H,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,IAAsB,EAAE,aAAqB;IACjE,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QAC1D,6BAA6B;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAAkB;IAClD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,OAAe;IAChD,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,8BAA8B;IAC9B,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,8BAA8B;IAC9B,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/analyzers/cycleCheck.d.ts

@@ -0,0 +1,12 @@
+import type { FileEntry, Issue } from '../types.js';
+/**
+ * Lift Tarjan-detected import cycles from the coupling analyzer into the
+ * doctor issue list. Each cycle yields ONE warning issue listing every file
+ * in the cycle as a location, so an agent calling `projscan_doctor` (which
+ * doesn't fetch coupling data on its own) still sees circular dependencies.
+ *
+ * Capped at MAX_CYCLES_REPORTED to keep the doctor output bounded on
+ * pathological codebases. Each issue's `locations` is capped at
+ * MAX_FILES_PER_CYCLE_ISSUE; the rest are listed in the description.
+ */
+export declare function check(rootPath: string, files: FileEntry[]): Promise<Issue[]>;

package/dist/analyzers/cycleCheck.js

@@ -0,0 +1,65 @@
+import { buildCodeGraph } from '../core/codeGraph.js';
+import { loadCachedGraph, saveCachedGraph } from '../core/indexCache.js';
+import { computeCoupling } from '../core/couplingAnalyzer.js';
+const MAX_FILES_PER_CYCLE_ISSUE = 8;
+const MAX_CYCLES_REPORTED = 20;
+/**
+ * Lift Tarjan-detected import cycles from the coupling analyzer into the
+ * doctor issue list. Each cycle yields ONE warning issue listing every file
+ * in the cycle as a location, so an agent calling `projscan_doctor` (which
+ * doesn't fetch coupling data on its own) still sees circular dependencies.
+ *
+ * Capped at MAX_CYCLES_REPORTED to keep the doctor output bounded on
+ * pathological codebases. Each issue's `locations` is capped at
+ * MAX_FILES_PER_CYCLE_ISSUE; the rest are listed in the description.
+ */
+export async function check(rootPath, files) {
+    // Build the graph (cache-first). saveCachedGraph is best-effort and won't
+    // throw on permissions issues.
+    const cached = await loadCachedGraph(rootPath);
+    let graph;
+    try {
+        graph = await buildCodeGraph(rootPath, files, cached);
+    }
+    catch {
+        // If graph building fails entirely (e.g. all parsers throw), skip silently.
+        return [];
+    }
+    await saveCachedGraph(rootPath, graph).catch(() => undefined);
+    const coupling = computeCoupling(graph);
+    if (coupling.cycles.length === 0)
+        return [];
+    const issues = [];
+    const cyclesToReport = coupling.cycles.slice(0, MAX_CYCLES_REPORTED);
+    for (let i = 0; i < cyclesToReport.length; i++) {
+        const cycle = cyclesToReport[i];
+        const id = `cycle-detected-${i + 1}`;
+        const locFiles = cycle.files.slice(0, MAX_FILES_PER_CYCLE_ISSUE);
+        const overflowCount = cycle.files.length - locFiles.length;
+        const filesPretty = cycle.files.join(', ');
+        const description = overflowCount > 0
+            ? `Circular import among ${cycle.size} files: ${filesPretty}. Resolve by introducing an interface boundary or moving shared types to a leaf module.`
+            : `Circular import among ${cycle.size} files: ${filesPretty}. Resolve by introducing an interface boundary or moving shared types to a leaf module.`;
+        issues.push({
+            id,
+            title: `Circular imports detected (${cycle.size} files)`,
+            description,
+            severity: 'warning',
+            category: 'architecture',
+            fixAvailable: false,
+            locations: locFiles.map((file) => ({ file })),
+        });
+    }
+    if (coupling.cycles.length > MAX_CYCLES_REPORTED) {
+        issues.push({
+            id: 'cycle-detected-overflow',
+            title: `${coupling.cycles.length - MAX_CYCLES_REPORTED} additional import cycles not reported`,
+            description: `Doctor caps cycle reporting at ${MAX_CYCLES_REPORTED} cycles. Run \`projscan coupling --cycles-only\` for the full list.`,
+            severity: 'info',
+            category: 'architecture',
+            fixAvailable: false,
+        });
+    }
+    return issues;
+}
+//# sourceMappingURL=cycleCheck.js.map

package/dist/analyzers/cycleCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cycleCheck.js","sourceRoot":"","sources":["../../src/analyzers/cycleCheck.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,yBAAyB,GAAG,CAAC,CAAC;AACpC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,QAAgB,EAAE,KAAkB;IAC9D,0EAA0E;IAC1E,+BAA+B;IAC/B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE9D,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE5C,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAErE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;QACjE,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAE3D,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,WAAW,GACf,aAAa,GAAG,CAAC;YACf,CAAC,CAAC,yBAAyB,KAAK,CAAC,IAAI,WAAW,WAAW,yFAAyF;YACpJ,CAAC,CAAC,yBAAyB,KAAK,CAAC,IAAI,WAAW,WAAW,yFAAyF,CAAC;QAEzJ,MAAM,CAAC,IAAI,CAAC;YACV,EAAE;YACF,KAAK,EAAE,8BAA8B,KAAK,CAAC,IAAI,SAAS;YACxD,WAAW;YACX,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,yBAAyB;YAC7B,KAAK,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,mBAAmB,wCAAwC;YAC9F,WAAW,EAAE,kCAAkC,mBAAmB,qEAAqE;YACvI,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/analyzers/unusedDependencyCheck.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { buildImportGraph } from '../core/importGraph.js';
+import { buildImportGraph, toPackageName } from '../core/importGraph.js';
+import { detectWorkspaces } from '../core/monorepo.js';
 import { findDependencyLines } from '../utils/packageJsonLocator.js';
 /**
  * Patterns for packages that are typically not imported directly from source
@@ -68,7 +69,52 @@ function isImplicitlyUsed(pkg) {
     return IMPLICIT_USE_PREFIXES.some((prefix) => pkg.startsWith(prefix));
 }
 export async function check(rootPath, files) {
-    const pkgPath = path.join(rootPath, 'package.json');
+    // Build the import graph once across the whole repo. We slice it per-package
+    // below for workspace-aware mode.
+    const fullGraph = await buildImportGraph(rootPath, files);
+    // Workspace detection. When the repo is a single package (kind 'none') or a
+    // root-only manifest with no real workspaces, we degrade to the original
+    // single-manifest path for full backward compatibility.
+    const ws = await detectWorkspaces(rootPath);
+    const realWorkspaces = ws.packages.filter((p) => !p.isRoot);
+    const isMonorepo = ws.kind !== 'none' && realWorkspaces.length > 0;
+    if (!isMonorepo) {
+        return await checkOnePackage(rootPath, '', fullGraph, files);
+    }
+    // Workspace-aware: check the root manifest (if any) AND each workspace package.
+    // Each gets its own deps-vs-imports comparison, scoped to the files that
+    // belong to that package by longest-prefix path matching.
+    const issues = [];
+    const rootPkg = ws.packages.find((p) => p.isRoot);
+    if (rootPkg) {
+        // Root manifest: only consider files NOT under any workspace package dir.
+        const claimedPrefixes = realWorkspaces
+            .map((p) => p.relativePath)
+            .filter((p) => p.length > 0);
+        const rootFiles = files.filter((f) => !claimedPrefixes.some((prefix) => f.relativePath.startsWith(prefix + '/')));
+        issues.push(...(await checkOnePackage(rootPath, '', fullGraph, rootFiles)));
+    }
+    for (const wp of realWorkspaces) {
+        const pkgDir = path.join(rootPath, wp.relativePath);
+        const prefix = wp.relativePath + '/';
+        const wpFiles = files.filter((f) => f.relativePath === wp.relativePath || f.relativePath.startsWith(prefix));
+        issues.push(...(await checkOnePackage(pkgDir, wp.relativePath, fullGraph, wpFiles)));
+    }
+    return issues;
+}
+/**
+ * Run the unused-dependency check against one package.json.
+ *
+ * @param packageDir absolute path to the directory containing package.json.
+ * @param locationPrefix path prefix (relative to repo root) used in issue
+ *   `locations.file`. Empty string for the repo root; e.g. `packages/foo` for
+ *   a workspace package - produces locations like `packages/foo/package.json`.
+ * @param fullGraph repo-wide import graph (built once and reused).
+ * @param scopedFiles file list this manifest is responsible for. We slice the
+ *   global graph down to imports from these files only.
+ */
+async function checkOnePackage(packageDir, locationPrefix, fullGraph, scopedFiles) {
+    const pkgPath = path.join(packageDir, 'package.json');
     let raw;
     try {
         raw = await fs.readFile(pkgPath, 'utf-8');
@@ -88,36 +134,42 @@ export async function check(rootPath, files) {
     const allDeclared = new Set([...Object.keys(dependencies), ...Object.keys(devDependencies)]);
     if (allDeclared.size === 0)
         return [];
-    const graph = await buildImportGraph(rootPath, files);
-    // Also treat packages invoked from package.json scripts as used.
-    // e.g., "build": "tsc" means we should not flag typescript.
+    // Project per-package usage: walk only the files this manifest covers and
+    // collect their external package names from the full graph's byFile map.
+    const usedPackages = new Set();
+    for (const f of scopedFiles) {
+        const specifiers = fullGraph.byFile.get(f.relativePath);
+        if (!specifiers)
+            continue;
+        for (const spec of specifiers) {
+            const name = toPackageName(spec);
+            if (name)
+                usedPackages.add(name);
+        }
+    }
     const scriptUsedBinaries = extractScriptBinaries(pkg);
-    const locations = await findDependencyLines(rootPath);
+    const locations = await findDependencyLines(packageDir);
+    const locationFile = locationPrefix ? `${locationPrefix}/package.json` : 'package.json';
     const unused = [];
     for (const name of allDeclared) {
-        if (graph.externalPackages.has(name))
+        if (usedPackages.has(name))
             continue;
         if (isImplicitlyUsed(name))
             continue;
         if (scriptUsedBinaries.has(name))
             continue;
-        // skip scoped bin lookups (e.g., "npx some-tool") - covered by scriptUsedBinaries
         const isDev = name in devDependencies;
         const line = locations?.lineOfDependency.get(name);
+        const inWorkspace = locationPrefix ? ` (workspace: ${locationPrefix})` : '';
         unused.push({
-            id: `unused-dependency-${name}`,
-            title: `Unused ${isDev ? 'dev' : ''} dependency: ${name}`.replace('  ', ' ').trim(),
-            description: `The package "${name}" is declared in package.json but never imported from source. If it's used only in package.json scripts or as a plugin, add it to the projscan allowlist via .projscanrc → disableRules.`,
+            id: locationPrefix ? `unused-dependency-${locationPrefix}-${name}` : `unused-dependency-${name}`,
+            title: `Unused ${isDev ? 'dev' : ''} dependency: ${name}${inWorkspace}`.replace('  ', ' ').trim(),
+            description: `The package "${name}" is declared in ${locationFile} but never imported from source files under that package. If it's used only in package.json scripts or as a plugin, add it to the projscan allowlist via .projscanrc → disableRules.`,
             severity: isDev ? 'info' : 'warning',
             category: 'dependencies',
             fixAvailable: false,
             locations: locations
-                ? [
-                    {
-                        file: 'package.json',
-                        line: line ?? 1,
-                    },
-                ]
+                ? [{ file: locationFile, line: line ?? 1 }]
                 : undefined,
         });
     }

package/dist/analyzers/unusedDependencyCheck.js.map

@@ -1 +1 @@
-{"version":3,"file":"unusedDependencyCheck.js","sourceRoot":"","sources":["../../src/analyzers/unusedDependencyCheck.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE;;;;GAIG;AACH,MAAM,qBAAqB,GAAG;IAC5B,SAAS;IACT,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,eAAe;IACf,mBAAmB;IACnB,mBAAmB;CACpB,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,YAAY;IACZ,SAAS;IACT,KAAK;IACL,MAAM;IACN,SAAS;IACT,MAAM;IACN,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,WAAW;IACX,OAAO;IACP,aAAa;IACb,YAAY;IACZ,iCAAiC;IACjC,kBAAkB;IAClB,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,WAAW;IACX,cAAc;IACd,SAAS;IACT,aAAa;IACb,YAAY;IACZ,IAAI;IACJ,UAAU;IACV,eAAe;IACf,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,OAAO;IACP,KAAK;IACL,KAAK;IACL,SAAS;IACT,kBAAkB;IAClB,SAAS;IACT,WAAW;IACX,kBAAkB;CACnB,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,QAAgB,EAAE,KAAkB;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAA2B,CAAC;IACxE,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAA2B,CAAC;IAC9E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC7F,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAEtD,iEAAiE;IACjE,4DAA4D;IAC5D,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAEtD,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/C,IAAI,gBAAgB,CAAC,IAAI,CAAC;YAAE,SAAS;QACrC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3C,kFAAkF;QAElF,MAAM,KAAK,GAAG,IAAI,IAAI,eAAe,CAAC;QACtC,MAAM,IAAI,GAAG,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEnD,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,qBAAqB,IAAI,EAAE;YAC/B,KAAK,EAAE,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,gBAAgB,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE;YACnF,WAAW,EAAE,gBAAgB,IAAI,0LAA0L;YAC3N,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACpC,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,SAAS;gBAClB,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,cAAc;wBACpB,IAAI,EAAE,IAAI,IAAI,CAAC;qBAChB;iBACF;gBACH,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,GAA4B;IACzD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAA2B,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC9C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"unusedDependencyCheck.js","sourceRoot":"","sources":["../../src/analyzers/unusedDependencyCheck.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE;;;;GAIG;AACH,MAAM,qBAAqB,GAAG;IAC5B,SAAS;IACT,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,eAAe;IACf,mBAAmB;IACnB,mBAAmB;CACpB,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,YAAY;IACZ,SAAS;IACT,KAAK;IACL,MAAM;IACN,SAAS;IACT,MAAM;IACN,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,WAAW;IACX,OAAO;IACP,aAAa;IACb,YAAY;IACZ,iCAAiC;IACjC,kBAAkB;IAClB,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,WAAW;IACX,cAAc;IACd,SAAS;IACT,aAAa;IACb,YAAY;IACZ,IAAI;IACJ,UAAU;IACV,eAAe;IACf,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,OAAO;IACP,KAAK;IACL,KAAK;IACL,SAAS;IACT,kBAAkB;IAClB,SAAS;IACT,WAAW;IACX,kBAAkB;CACnB,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,QAAgB,EAAE,KAAkB;IAC9D,6EAA6E;IAC7E,kCAAkC;IAClC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE1D,4EAA4E;IAC5E,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAEnE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,MAAM,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,gFAAgF;IAChF,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,OAAO,EAAE,CAAC;QACZ,0EAA0E;QAC1E,MAAM,eAAe,GAAG,cAAc;aACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;aAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAClF,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,GAAG,GAAG,CAAC;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,EAAE,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7G,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,eAAe,CAC5B,UAAkB,EAClB,cAAsB,EACtB,SAAuD,EACvD,WAAwB;IAExB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACtD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAA2B,CAAC;IACxE,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAA2B,CAAC;IAC9E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC7F,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,IAAI;gBAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;IACxF,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACrC,IAAI,gBAAgB,CAAC,IAAI,CAAC;YAAE,SAAS;QACrC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAE3C,MAAM,KAAK,GAAG,IAAI,IAAI,eAAe,CAAC;QACtC,MAAM,IAAI,GAAG,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,gBAAgB,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAE5E,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC,qBAAqB,cAAc,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE;YAChG,KAAK,EAAE,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,gBAAgB,IAAI,GAAG,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE;YACjG,WAAW,EAAE,gBAAgB,IAAI,oBAAoB,YAAY,sLAAsL;YACvP,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACpC,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,SAAS;gBAClB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;gBAC3C,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,GAA4B;IACzD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAA2B,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC9C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/_shared.d.ts

@@ -0,0 +1,16 @@
+import { Command } from 'commander';
+import type { ArchitectureLayer, FileExplanation, Issue, ProjscanConfig, ReportFormat, FileEntry, DirectoryNode } from '../types.js';
+export declare const pkg: any;
+export declare const program: Command;
+export declare function getFormat(): ReportFormat;
+export declare function getRootPath(): string;
+export declare function loadProjectConfig(): Promise<ProjscanConfig>;
+export declare function filterIssuesByChangedFiles(issues: Issue[], rootPath: string, baseRef?: string): Promise<Issue[]>;
+export declare function setupLogLevel(): void;
+export declare function maybeBanner(): void;
+export declare function maybeCompactBanner(): void;
+/** Walk a DirectoryNode to find the node whose `path` matches targetPath. */
+export declare function sliceCliTree(node: DirectoryNode, targetPath: string): DirectoryNode | null;
+export declare function analyzeFile(filePath: string, content: string): FileExplanation;
+export declare function buildArchitectureLayers(files: FileEntry[], frameworkNames: string[]): ArchitectureLayer[];
+export declare function promptYesNo(question: string): Promise<boolean>;