projscan 0.3.1 → 0.4.0

package/dist/core/auditRunner.js

@@ -0,0 +1,222 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+const execFileAsync = promisify(execFile);
+const EMPTY_SUMMARY = {
+    critical: 0,
+    high: 0,
+    moderate: 0,
+    low: 0,
+    info: 0,
+};
+/**
+ * Run `npm audit --json` and normalize the output.
+ *
+ * npm's audit JSON format has changed between npm 6/7/8/9+ — we handle the
+ * modern format (npm 7+) first and fall back to a friendly error otherwise.
+ * Yarn/pnpm projects: we don't try to translate; we report "not available"
+ * with a hint.
+ */
+export async function runAudit(rootPath, options = {}) {
+    const hasPackageJson = await fileExists(path.join(rootPath, 'package.json'));
+    if (!hasPackageJson) {
+        return unavailable('No package.json found in this directory');
+    }
+    const hasNpmLock = await fileExists(path.join(rootPath, 'package-lock.json'));
+    const hasYarnLock = await fileExists(path.join(rootPath, 'yarn.lock'));
+    const hasPnpmLock = await fileExists(path.join(rootPath, 'pnpm-lock.yaml'));
+    if (!hasNpmLock) {
+        if (hasYarnLock) {
+            return unavailable('yarn.lock detected — run `yarn npm audit` instead');
+        }
+        if (hasPnpmLock) {
+            return unavailable('pnpm-lock.yaml detected — run `pnpm audit` instead');
+        }
+        return unavailable('No package-lock.json — run `npm install` first, then retry');
+    }
+    const timeoutMs = options.timeoutMs ?? 60_000;
+    let stdout;
+    try {
+        const result = await execFileAsync('npm', ['audit', '--json'], {
+            cwd: rootPath,
+            maxBuffer: 16 * 1024 * 1024,
+            timeout: timeoutMs,
+        });
+        stdout = result.stdout;
+    }
+    catch (err) {
+        // `npm audit` exits non-zero when vulnerabilities exist — this is normal.
+        // The stdout still contains the JSON payload.
+        const e = err;
+        if (typeof e.stdout === 'string' && e.stdout) {
+            stdout = e.stdout;
+        }
+        else if (e.stdout instanceof Buffer) {
+            stdout = e.stdout.toString('utf-8');
+        }
+        else {
+            return unavailable(`npm audit failed: ${e.message ?? 'unknown error'}`);
+        }
+    }
+    if (!stdout)
+        return unavailable('npm audit returned no output');
+    let payload;
+    try {
+        payload = JSON.parse(stdout);
+    }
+    catch {
+        return unavailable('npm audit returned invalid JSON');
+    }
+    return normalize(payload);
+}
+function normalize(payload) {
+    // Modern format (npm 7+): { vulnerabilities: { name: { severity, via, range, fixAvailable, ... } }, metadata: { vulnerabilities: { critical, high, ... } } }
+    const vulns = payload.vulnerabilities;
+    const metadata = payload.metadata;
+    if (!vulns || typeof vulns !== 'object') {
+        return {
+            available: true,
+            summary: { ...EMPTY_SUMMARY },
+            findings: [],
+        };
+    }
+    const findings = [];
+    for (const [name, info] of Object.entries(vulns)) {
+        if (!info || typeof info !== 'object')
+            continue;
+        const entry = info;
+        const severity = normalizeSeverity(entry.severity);
+        const via = normalizeVia(entry.via);
+        const fixAvailable = entry.fixAvailable !== false && entry.fixAvailable !== undefined;
+        findings.push({
+            name,
+            severity,
+            title: extractTitle(via, name, severity),
+            url: extractUrl(via),
+            cve: extractCves(via),
+            via,
+            range: typeof entry.range === 'string' ? entry.range : undefined,
+            fixAvailable,
+        });
+    }
+    const summary = { ...EMPTY_SUMMARY };
+    if (metadata?.vulnerabilities) {
+        for (const k of ['critical', 'high', 'moderate', 'low', 'info']) {
+            summary[k] = metadata.vulnerabilities[k] ?? 0;
+        }
+    }
+    else {
+        for (const f of findings)
+            summary[f.severity]++;
+    }
+    findings.sort((a, b) => severityWeight(b.severity) - severityWeight(a.severity));
+    return {
+        available: true,
+        summary,
+        findings,
+    };
+}
+function normalizeSeverity(raw) {
+    if (typeof raw !== 'string')
+        return 'info';
+    const v = raw.toLowerCase();
+    if (v === 'critical' || v === 'high' || v === 'moderate' || v === 'low' || v === 'info') {
+        return v;
+    }
+    return 'info';
+}
+function normalizeVia(raw) {
+    if (!raw)
+        return [];
+    if (typeof raw === 'string')
+        return [raw];
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const item of raw) {
+        if (typeof item === 'string')
+            out.push(item);
+        else if (item && typeof item === 'object' && 'name' in item) {
+            out.push(String(item.name));
+        }
+    }
+    return out;
+}
+function extractTitle(via, name, severity) {
+    const first = via[0];
+    if (first && first !== name)
+        return `${first} (${severity})`;
+    return `Vulnerability in ${name} (${severity})`;
+}
+function extractUrl(via) {
+    if (!Array.isArray(via))
+        return undefined;
+    for (const item of via) {
+        if (item && typeof item === 'object' && 'url' in item) {
+            const url = item.url;
+            if (typeof url === 'string')
+                return url;
+        }
+    }
+    return undefined;
+}
+function extractCves(via) {
+    if (!Array.isArray(via))
+        return undefined;
+    const cves = new Set();
+    for (const item of via) {
+        if (item && typeof item === 'object' && 'cwe' in item) {
+            const cwe = item.cwe;
+            if (Array.isArray(cwe))
+                for (const c of cwe)
+                    if (typeof c === 'string')
+                        cves.add(c);
+        }
+    }
+    return cves.size > 0 ? [...cves] : undefined;
+}
+function severityWeight(s) {
+    return { critical: 5, high: 4, moderate: 3, low: 2, info: 1 }[s];
+}
+function unavailable(reason) {
+    return {
+        available: false,
+        reason,
+        summary: { ...EMPTY_SUMMARY },
+        findings: [],
+    };
+}
+async function fileExists(p) {
+    try {
+        await fs.access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Convert an AuditReport into projscan Issues for SARIF emission. */
+export function auditFindingsToIssues(report) {
+    if (!report.available)
+        return [];
+    const severityMap = {
+        critical: 'error',
+        high: 'error',
+        moderate: 'warning',
+        low: 'info',
+        info: 'info',
+    };
+    return report.findings.map((f) => ({
+        id: `audit-${f.name}`,
+        title: f.title,
+        description: f.url !== undefined
+            ? `${f.title} — ${f.url}${f.range ? ` (range: ${f.range})` : ''}`
+            : `${f.title}${f.range ? ` (range: ${f.range})` : ''}`,
+        severity: severityMap[f.severity],
+        category: 'security',
+        fixAvailable: f.fixAvailable,
+        locations: [{ file: 'package.json' }],
+    }));
+}
+//# sourceMappingURL=auditRunner.js.map

package/dist/core/auditRunner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditRunner.js","sourceRoot":"","sources":["../../src/core/auditRunner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,aAAa,GAAkC;IACnD,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;IACX,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AAOF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,QAAgB,EAChB,UAAwB,EAAE;IAE1B,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,WAAW,CAAC,yCAAyC,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAE5E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC,mDAAmD,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC,oDAAoD,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,WAAW,CAAC,4DAA4D,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;YAC7D,GAAG,EAAE,QAAQ;YACb,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,8CAA8C;QAC9C,MAAM,CAAC,GAAG,GAAoE,CAAC;QAC/E,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YAC7C,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACpB,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,YAAY,MAAM,EAAE,CAAC;YACtC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,OAAO,WAAW,CAAC,qBAAqB,CAAC,CAAC,OAAO,IAAI,eAAe,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC,8BAA8B,CAAC,CAAC;IAEhE,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA4B,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,iCAAiC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS,CAAC,OAAgC;IACjD,6JAA6J;IAC7J,MAAM,KAAK,GAAG,OAAO,CAAC,eAAsD,CAAC;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAoE,CAAC;IAE9F,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO;YACL,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE;YAC7B,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QAChD,MAAM,KAAK,GAAG,IAA+B,CAAC;QAC9C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,KAAK,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC;QAEtF,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,QAAQ;YACR,KAAK,EAAE,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC;YACxC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC;YACpB,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC;YACrB,GAAG;YACH,KAAK,EAAE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YAChE,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAkC,EAAE,GAAG,aAAa,EAAE,CAAC;IACpE,IAAI,QAAQ,EAAE,eAAe,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAoB,EAAE,CAAC;YACnF,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IAClD,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEjF,OAAO;QACL,SAAS,EAAE,IAAI;QACf,OAAO;QACP,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC3C,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC5B,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;QACxF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACxC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YAC5D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAE,IAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,GAAa,EAAE,IAAY,EAAE,QAAuB;IACxE,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,KAAK,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,GAAG,KAAK,KAAK,QAAQ,GAAG,CAAC;IAC7D,OAAO,oBAAoB,IAAI,KAAK,QAAQ,GAAG,CAAC;AAClD,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YACtD,MAAM,GAAG,GAAI,IAAyB,CAAC,GAAG,CAAC;YAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YACtD,MAAM,GAAG,GAAI,IAAyB,CAAC,GAAG,CAAC;YAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,KAAK,MAAM,CAAC,IAAI,GAAG;oBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,cAAc,CAAC,CAAgB;IACtC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,MAAM;QACN,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE;QAC7B,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,CAAS;IACjC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,qBAAqB,CAAC,MAAmB;IACvD,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,WAAW,GAAwD;QACvE,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,SAAS;QACnB,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,MAAM;KACb,CAAC;IACF,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE;QACrB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,WAAW,EACT,CAAC,CAAC,GAAG,KAAK,SAAS;YACjB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACjE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1D,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjC,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;KACtC,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/core/importGraph.d.ts

@@ -0,0 +1,31 @@
+import type { FileEntry } from '../types.js';
+export interface ImportGraph {
+    /** file → set of import specifiers exactly as they appear in source */
+    byFile: Map<string, Set<string>>;
+    /** unique set of non-relative, non-builtin specifiers (package names) */
+    externalPackages: Set<string>;
+    /** count of source files scanned */
+    scannedFiles: number;
+}
+/**
+ * Walk source files and build an import graph. Extracts ES imports and
+ * CommonJS requires; falls back silently on unreadable / oversized files.
+ */
+export declare function buildImportGraph(rootPath: string, files: FileEntry[]): Promise<ImportGraph>;
+/**
+ * Convert an import specifier to a bare package name.
+ * Returns null for relative paths ("./", "../", "/"), node: builtins, and bare builtins.
+ *
+ *   'react'           -> 'react'
+ *   'react/jsx-runtime' -> 'react'
+ *   '@types/node'     -> '@types/node'
+ *   '@scope/pkg/deep' -> '@scope/pkg'
+ *   './local'         -> null
+ *   'node:fs'         -> null
+ *   'fs'              -> null (node builtin)
+ */
+export declare function toPackageName(specifier: string): string | null;
+/** Check if a package is referenced by at least one file in the graph. */
+export declare function isPackageUsed(graph: ImportGraph, pkg: string): boolean;
+/** List files that import a given package. */
+export declare function filesImporting(graph: ImportGraph, pkg: string): string[];

package/dist/core/importGraph.js

@@ -0,0 +1,139 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { extractImports } from './fileInspector.js';
+const SOURCE_EXTENSIONS = new Set([
+    '.ts',
+    '.tsx',
+    '.js',
+    '.jsx',
+    '.mjs',
+    '.cjs',
+    '.mts',
+    '.cts',
+]);
+const MAX_FILE_SIZE = 1024 * 1024; // 1 MB — skip giant generated files
+const NODE_BUILTINS = new Set([
+    'assert',
+    'async_hooks',
+    'buffer',
+    'child_process',
+    'cluster',
+    'console',
+    'constants',
+    'crypto',
+    'dgram',
+    'dns',
+    'domain',
+    'events',
+    'fs',
+    'fs/promises',
+    'http',
+    'http2',
+    'https',
+    'inspector',
+    'module',
+    'net',
+    'os',
+    'path',
+    'perf_hooks',
+    'process',
+    'punycode',
+    'querystring',
+    'readline',
+    'repl',
+    'stream',
+    'string_decoder',
+    'sys',
+    'timers',
+    'tls',
+    'trace_events',
+    'tty',
+    'url',
+    'util',
+    'v8',
+    'vm',
+    'wasi',
+    'worker_threads',
+    'zlib',
+]);
+/**
+ * Walk source files and build an import graph. Extracts ES imports and
+ * CommonJS requires; falls back silently on unreadable / oversized files.
+ */
+export async function buildImportGraph(rootPath, files) {
+    const byFile = new Map();
+    const externalPackages = new Set();
+    let scannedFiles = 0;
+    const sourceFiles = files.filter((f) => SOURCE_EXTENSIONS.has(f.extension) && f.sizeBytes <= MAX_FILE_SIZE);
+    await Promise.all(sourceFiles.map(async (file) => {
+        const abs = path.isAbsolute(file.absolutePath)
+            ? file.absolutePath
+            : path.resolve(rootPath, file.relativePath);
+        let content;
+        try {
+            content = await fs.readFile(abs, 'utf-8');
+        }
+        catch {
+            return;
+        }
+        scannedFiles++;
+        const imports = extractImports(content);
+        const specifiers = new Set();
+        for (const imp of imports) {
+            specifiers.add(imp.source);
+            const pkg = toPackageName(imp.source);
+            if (pkg && !NODE_BUILTINS.has(pkg) && !pkg.startsWith('node:')) {
+                externalPackages.add(pkg);
+            }
+        }
+        byFile.set(file.relativePath, specifiers);
+    }));
+    return { byFile, externalPackages, scannedFiles };
+}
+/**
+ * Convert an import specifier to a bare package name.
+ * Returns null for relative paths ("./", "../", "/"), node: builtins, and bare builtins.
+ *
+ *   'react'           -> 'react'
+ *   'react/jsx-runtime' -> 'react'
+ *   '@types/node'     -> '@types/node'
+ *   '@scope/pkg/deep' -> '@scope/pkg'
+ *   './local'         -> null
+ *   'node:fs'         -> null
+ *   'fs'              -> null (node builtin)
+ */
+export function toPackageName(specifier) {
+    if (!specifier)
+        return null;
+    if (specifier.startsWith('.') || specifier.startsWith('/'))
+        return null;
+    if (specifier.startsWith('node:'))
+        return null;
+    if (NODE_BUILTINS.has(specifier))
+        return null;
+    if (specifier.startsWith('@')) {
+        const segments = specifier.split('/');
+        if (segments.length < 2)
+            return null;
+        return `${segments[0]}/${segments[1]}`;
+    }
+    return specifier.split('/')[0];
+}
+/** Check if a package is referenced by at least one file in the graph. */
+export function isPackageUsed(graph, pkg) {
+    return graph.externalPackages.has(pkg);
+}
+/** List files that import a given package. */
+export function filesImporting(graph, pkg) {
+    const out = [];
+    for (const [file, specifiers] of graph.byFile) {
+        for (const spec of specifiers) {
+            if (toPackageName(spec) === pkg) {
+                out.push(file);
+                break;
+            }
+        }
+    }
+    return out.sort();
+}
+//# sourceMappingURL=importGraph.js.map

package/dist/core/importGraph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"importGraph.js","sourceRoot":"","sources":["../../src/core/importGraph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,oCAAoC;AAWvE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,QAAQ;IACR,aAAa;IACb,QAAQ;IACR,eAAe;IACf,SAAS;IACT,SAAS;IACT,WAAW;IACX,QAAQ;IACR,OAAO;IACP,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,IAAI;IACJ,aAAa;IACb,MAAM;IACN,OAAO;IACP,OAAO;IACP,WAAW;IACX,QAAQ;IACR,KAAK;IACL,IAAI;IACJ,MAAM;IACN,YAAY;IACZ,SAAS;IACT,UAAU;IACV,aAAa;IACb,UAAU;IACV,MAAM;IACN,QAAQ;IACR,gBAAgB;IAChB,KAAK;IACL,QAAQ;IACR,KAAK;IACL,cAAc;IACd,KAAK;IACL,KAAK;IACL,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,gBAAgB;IAChB,MAAM;CACP,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,KAAkB;IAElB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,aAAa,CAC1E,CAAC;IAEF,MAAM,OAAO,CAAC,GAAG,CACf,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;YAC5C,CAAC,CAAC,IAAI,CAAC,YAAY;YACnB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,YAAY,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/D,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,CAAC;IAED,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,KAAkB,EAAE,GAAW;IAC3D,OAAO,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,cAAc,CAAC,KAAkB,EAAE,GAAW;IAC5D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAChC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACf,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC"}

package/dist/core/issueEngine.js

@@ -4,6 +4,7 @@ import { check as testCheck } from '../analyzers/testCheck.js';
 import { check as architectureCheck } from '../analyzers/architectureCheck.js';
 import { check as dependencyRiskCheck } from '../analyzers/dependencyRiskCheck.js';
 import { check as securityCheck } from '../analyzers/securityCheck.js';
+import { check as unusedDependencyCheck } from '../analyzers/unusedDependencyCheck.js';
 const checkers = [
     eslintCheck,
     prettierCheck,
@@ -11,6 +12,7 @@ const checkers = [
     architectureCheck,
     dependencyRiskCheck,
     securityCheck,
+    unusedDependencyCheck,
 ];
 export async function collectIssues(rootPath, files) {
     const results = await Promise.all(checkers.map((check) => check(rootPath, files)));

package/dist/core/issueEngine.js.map

@@ -1 +1 @@
-{"version":3,"file":"issueEngine.js","sourceRoot":"","sources":["../../src/core/issueEngine.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,KAAK,IAAI,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,KAAK,IAAI,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,KAAK,IAAI,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,KAAK,IAAI,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAIvE,MAAM,QAAQ,GAAc;IAC1B,WAAW;IACX,aAAa;IACb,SAAS;IACT,iBAAiB;IACjB,mBAAmB;IACnB,aAAa;CACd,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,KAAkB;IACtE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAE9B,2CAA2C;IAC3C,MAAM,aAAa,GAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAChF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3F,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"issueEngine.js","sourceRoot":"","sources":["../../src/core/issueEngine.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,KAAK,IAAI,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,KAAK,IAAI,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,KAAK,IAAI,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,KAAK,IAAI,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,KAAK,IAAI,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAIvF,MAAM,QAAQ,GAAc;IAC1B,WAAW;IACX,aAAa;IACb,SAAS;IACT,iBAAiB;IACjB,mBAAmB;IACnB,aAAa;IACb,qBAAqB;CACtB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,KAAkB;IACtE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAE9B,2CAA2C;IAC3C,MAAM,aAAa,GAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAChF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3F,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/outdatedDetector.d.ts

@@ -0,0 +1,9 @@
+import type { OutdatedReport } from '../types.js';
+/**
+ * Offline outdated check — compares the version declared in package.json
+ * to the version installed under node_modules/<pkg>/package.json.
+ *
+ * Does not hit the npm registry. `latest` is filled in only when a node_modules
+ * install exists; the drift calculation uses installed vs declared.
+ */
+export declare function detectOutdated(rootPath: string): Promise<OutdatedReport>;

package/dist/core/outdatedDetector.js

@@ -0,0 +1,87 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { drift as semverDrift } from '../utils/semver.js';
+/**
+ * Offline outdated check — compares the version declared in package.json
+ * to the version installed under node_modules/<pkg>/package.json.
+ *
+ * Does not hit the npm registry. `latest` is filled in only when a node_modules
+ * install exists; the drift calculation uses installed vs declared.
+ */
+export async function detectOutdated(rootPath) {
+    const pkgPath = path.join(rootPath, 'package.json');
+    let raw;
+    try {
+        raw = await fs.readFile(pkgPath, 'utf-8');
+    }
+    catch {
+        return {
+            available: false,
+            reason: 'No package.json found in this directory',
+            totalPackages: 0,
+            packages: [],
+        };
+    }
+    let pkg;
+    try {
+        pkg = JSON.parse(raw);
+    }
+    catch {
+        return {
+            available: false,
+            reason: 'package.json is not valid JSON',
+            totalPackages: 0,
+            packages: [],
+        };
+    }
+    const dependencies = (pkg.dependencies ?? {});
+    const devDependencies = (pkg.devDependencies ?? {});
+    const entries = [
+        ...Object.entries(dependencies).map(([n, v]) => [n, v, 'dependency']),
+        ...Object.entries(devDependencies).map(([n, v]) => [n, v, 'devDependency']),
+    ];
+    const nodeModules = path.join(rootPath, 'node_modules');
+    const nodeModulesExists = await pathExists(nodeModules);
+    const packages = [];
+    for (const [name, declared, scope] of entries) {
+        let installed = null;
+        if (nodeModulesExists) {
+            installed = await readInstalledVersion(nodeModules, name);
+        }
+        const drift = semverDrift(declared, installed);
+        packages.push({
+            name,
+            declared,
+            installed,
+            latest: installed, // without registry lookup, installed is the best we know
+            drift,
+            scope,
+        });
+    }
+    return {
+        available: true,
+        totalPackages: packages.length,
+        packages,
+    };
+}
+async function pathExists(p) {
+    try {
+        await fs.access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function readInstalledVersion(nodeModules, name) {
+    const installedPath = path.join(nodeModules, name, 'package.json');
+    try {
+        const raw = await fs.readFile(installedPath, 'utf-8');
+        const pkg = JSON.parse(raw);
+        return pkg.version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=outdatedDetector.js.map

package/dist/core/outdatedDetector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outdatedDetector.js","sourceRoot":"","sources":["../../src/core/outdatedDetector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE1D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,yCAAyC;YACjD,aAAa,EAAE,CAAC;YAChB,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,gCAAgC;YACxC,aAAa,EAAE,CAAC;YAChB,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAA2B,CAAC;IACxE,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAA2B,CAAC;IAE9E,MAAM,OAAO,GAA4D;QACvE,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CACjC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,CAAmC,CACnE;QACD,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,GAAG,CACpC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,eAAe,CAAsC,CACzE;KACF,CAAC;IAEF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACxD,MAAM,iBAAiB,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QAC9C,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,iBAAiB,EAAE,CAAC;YACtB,SAAS,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,QAAQ;YACR,SAAS;YACT,MAAM,EAAE,SAAS,EAAE,yDAAyD;YAC5E,KAAK;YACL,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,CAAS;IACjC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,WAAmB,EAAE,IAAY;IACnE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACpD,OAAO,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/core/upgradePreview.d.ts

@@ -0,0 +1,2 @@
+import type { FileEntry, UpgradePreview } from '../types.js';
+export declare function previewUpgrade(rootPath: string, pkgName: string, files: FileEntry[]): Promise<UpgradePreview>;