projscan 0.3.1 → 0.5.0

package/README.md

@@ -68,6 +68,10 @@ projscan fix                        # Auto-fix detected issues
 projscan ci                         # CI health gate (exits 1 on low score)
 projscan ci --changed-only          # Gate only on this PR's diff
 projscan ci --format sarif          # SARIF 2.1.0 for GitHub Code Scanning
+projscan outdated                   # Declared-vs-installed drift (offline)
+projscan audit                      # npm audit, normalized + SARIF-ready
+projscan upgrade <pkg>              # Preview upgrade impact (local CHANGELOG + importers)
+projscan coverage                   # Coverage × hotspots — scariest untested files
 projscan diff                       # Compare health + hotspot trends against a baseline
 projscan diagram                    # Architecture visualization
 projscan structure                  # Directory tree
@@ -93,6 +97,10 @@ For a comprehensive walkthrough, see the **[Full Guide](docs/GUIDE.md)**.
 | `projscan diagram` | ASCII architecture diagram of your project |
 | `projscan structure` | Directory tree with file counts |
 | `projscan dependencies` | Dependency analysis — counts, risks, recommendations |
+| `projscan outdated` | Declared-vs-installed drift check (offline) |
+| `projscan audit` | `npm audit`-powered vulnerability report — SARIF-ready for Code Scanning |
+| `projscan upgrade <pkg>` | Preview upgrade impact — local CHANGELOG + importer list, offline |
+| `projscan coverage` | **Coverage × hotspots — rank the scariest untested files** |
 | `projscan badge` | Generate a health score badge for your README |
 | `projscan mcp` | Run as an MCP server for AI coding agents (Claude Code, Cursor, …) |
 
@@ -329,11 +337,60 @@ projscan diff                           # Shows which hotspots rose / fell
 
 The baseline file now captures top hotspots too, so `diff` surfaces files that are **getting worse** (not just new issues).
 
+## Dependency Health
+
+projscan ships three focused commands for keeping your dependency graph healthy — all **offline** by default, no registry calls.
+
+```bash
+projscan outdated                       # Which declared deps drift from what's installed?
+projscan outdated --format json         # Machine-readable drift report
+projscan audit                          # Wrap npm audit; normalized, SARIF-ready
+projscan audit --format sarif > a.sarif # Upload to GitHub Code Scanning
+projscan upgrade chalk                  # What breaks if I bump chalk? Who imports it?
+projscan upgrade chalk --format markdown # Paste-ready review comment
+```
+
+### What each one tells you
+
+- **`outdated`** — reads `package.json` and `node_modules/<pkg>/package.json` to classify drift (`major` / `minor` / `patch` / `same` / `unknown`). No network.
+- **`audit`** — wraps `npm audit --json`, normalizes the output, and emits SARIF with per-finding rules anchored to `package.json`. Graceful fallback message for yarn/pnpm projects.
+- **`upgrade <pkg>`** — reads `node_modules/<pkg>/CHANGELOG.md`, slices the section between your installed version and the previous one, flags `BREAKING CHANGE` / `deprecated` / `removed support` markers, and lists every file in your repo that imports the package. All offline.
+
+### Unused dependencies (automatic in `doctor`)
+
+`projscan doctor` now flags declared dependencies that are never imported from source. Each finding is anchored to the **exact line in `package.json`** so GitHub Code Scanning PR annotations land in the right place.
+
+Implicit-use packages (typescript, eslint/prettier plugins, `@types/*`, and anything invoked from a `package.json` script) are allowlisted. Override via `.projscanrc` → `disableRules` if projscan flags something that is used but not imported.
+
+## Coverage × Hotspots — Scariest Untested Files
+
+`projscan coverage` joins your test coverage with the hotspot ranking. A file with high churn and low coverage is where a bug is most likely to bite you — so that's where you want tests first.
+
+```bash
+projscan coverage                       # Top 30 scariest untested files
+projscan coverage --format markdown     # Paste into a tech-debt ticket
+projscan coverage --format json         # Machine-readable for dashboards
+```
+
+**How it decides "scariest":** `priority = riskScore × (0.3 + 0.7 × uncoveredFraction)` — so a file with 50 risk and 10% coverage outranks a file with 50 risk and 95% coverage.
+
+**Which coverage files are supported:**
+
+- `coverage/lcov.info` (lcov — Vitest, Jest, c8)
+- `coverage/coverage-final.json` (Istanbul per-file detail)
+- `coverage/coverage-summary.json` (Istanbul summary)
+
+Coverage is also automatically joined into `projscan hotspots` when one of those files exists — no flag needed. Uncovered churning files get a score bump and a `low coverage (X%)` reason tag.
+
+### Dead-code detection (automatic in `doctor`)
+
+`projscan doctor` now flags source files whose exports nothing imports — dead code left over from refactors or utilities that were never wired up. Respects `package.json` public entry points (`main`, `exports`, `bin`, `types`), skips test files and barrel (`index`) files.
+
 ## AI Agent Integration (MCP)
 
 **`projscan mcp`** starts an [MCP](https://modelcontextprotocol.io) server over stdio so AI coding agents can query projscan during a session.
 
-**Tools** (7):
+**Tools** (11):
 - `projscan_analyze` — full project report
 - `projscan_doctor` — health score + issues
 - `projscan_hotspots` — risk-ranked files (with `limit`, `since` args)
@@ -341,6 +398,10 @@ The baseline file now captures top hotspots too, so `diff` surfaces files that a
 - `projscan_explain` — per-file purpose, imports, exports, smells
 - `projscan_structure` — directory tree
 - `projscan_dependencies` — package audit
+- `projscan_outdated` — declared-vs-installed drift
+- `projscan_audit` — npm audit, normalized
+- `projscan_upgrade` — offline upgrade preview with CHANGELOG + importers
+- `projscan_coverage` — coverage × hotspots, "scariest untested files"
 
 **Prompts** (2, parameterized with live project data):
 - `prioritize_refactoring` — ranked plan grounded in current hotspots

package/dist/analyzers/deadCodeCheck.d.ts

@@ -0,0 +1,18 @@
+import type { FileEntry, Issue } from '../types.js';
+/**
+ * Flag exports that are never imported anywhere in the project. This catches:
+ * - dead named exports left over from refactors
+ * - utilities that are implemented but never hooked up
+ *
+ * Does NOT flag:
+ * - files listed as the package's public entry points (main, exports, types, bin)
+ * - default exports (too many false positives — framework conventions)
+ * - test files (they're not supposed to export)
+ * - index files (barrels re-export for public use)
+ *
+ * False-positive guard: if a file is the target of at least one import, we treat
+ * all its exports as "possibly used" — the regex-based graph can't tell which
+ * named export is imported via `import { ... } from './barrel'`. This keeps
+ * noise low at the cost of missing some dead exports that live in used files.
+ */
+export declare function check(rootPath: string, files: FileEntry[]): Promise<Issue[]>;

package/dist/analyzers/deadCodeCheck.js

@@ -0,0 +1,168 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { buildImportGraph } from '../core/importGraph.js';
+import { extractExports } from '../core/fileInspector.js';
+const SOURCE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.mts', '.cts']);
+// Never flag these — they're public API by definition
+const PUBLIC_PATH_PREFIXES = ['src/index', 'index.'];
+/**
+ * Flag exports that are never imported anywhere in the project. This catches:
+ * - dead named exports left over from refactors
+ * - utilities that are implemented but never hooked up
+ *
+ * Does NOT flag:
+ * - files listed as the package's public entry points (main, exports, types, bin)
+ * - default exports (too many false positives — framework conventions)
+ * - test files (they're not supposed to export)
+ * - index files (barrels re-export for public use)
+ *
+ * False-positive guard: if a file is the target of at least one import, we treat
+ * all its exports as "possibly used" — the regex-based graph can't tell which
+ * named export is imported via `import { ... } from './barrel'`. This keeps
+ * noise low at the cost of missing some dead exports that live in used files.
+ */
+export async function check(rootPath, files) {
+    const sourceFiles = files.filter((f) => SOURCE_EXTENSIONS.has(f.extension));
+    if (sourceFiles.length === 0)
+        return [];
+    const publicEntries = await loadPublicEntries(rootPath);
+    const graph = await buildImportGraph(rootPath, sourceFiles);
+    // Build a set of files that are the target of at least one relative import.
+    // A relative import specifier is resolved against its importing file's dir,
+    // so we convert each relative specifier into a candidate target path.
+    const importedTargets = new Set();
+    for (const [importingFile, specifiers] of graph.byFile) {
+        const importingDir = path.posix.dirname(importingFile);
+        for (const spec of specifiers) {
+            if (!spec.startsWith('.'))
+                continue;
+            const resolved = path.posix.normalize(path.posix.join(importingDir, spec));
+            for (const candidate of resolutionCandidates(resolved)) {
+                importedTargets.add(candidate);
+            }
+        }
+    }
+    const issues = [];
+    for (const file of sourceFiles) {
+        if (isTestFile(file.relativePath))
+            continue;
+        if (isBarrelFile(file.relativePath))
+            continue;
+        if (isPublicEntry(file.relativePath, publicEntries))
+            continue;
+        if (importedTargets.has(file.relativePath))
+            continue;
+        if (importedTargets.has(stripExtension(file.relativePath)))
+            continue;
+        let content;
+        try {
+            content = await fs.readFile(file.absolutePath, 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        const exports = extractExports(content).filter((e) => e.type !== 'default' && e.name !== 'default');
+        if (exports.length === 0)
+            continue;
+        issues.push({
+            id: `unused-exports-${file.relativePath}`,
+            title: `Unused exports in ${file.relativePath}`,
+            description: `${exports.length} named export${exports.length === 1 ? '' : 's'} (${exports
+                .slice(0, 5)
+                .map((e) => e.name)
+                .join(', ')}${exports.length > 5 ? `, … +${exports.length - 5}` : ''}) but nothing in the project imports this file. Dead code or awaiting wiring?`,
+            severity: 'info',
+            category: 'architecture',
+            fixAvailable: false,
+            locations: [{ file: file.relativePath, line: 1 }],
+        });
+    }
+    return issues;
+}
+function isTestFile(relativePath) {
+    return (relativePath.includes('.test.') ||
+        relativePath.includes('.spec.') ||
+        relativePath.includes('__tests__') ||
+        relativePath.startsWith('tests/'));
+}
+function isBarrelFile(relativePath) {
+    const base = path.basename(relativePath, path.extname(relativePath));
+    return base === 'index';
+}
+function isPublicEntry(relativePath, publicEntries) {
+    if (publicEntries.has(relativePath))
+        return true;
+    if (publicEntries.has(stripExtension(relativePath)))
+        return true;
+    for (const prefix of PUBLIC_PATH_PREFIXES) {
+        if (relativePath === prefix || relativePath.startsWith(prefix))
+            return true;
+    }
+    return false;
+}
+function stripExtension(p) {
+    const ext = path.extname(p);
+    return ext ? p.slice(0, -ext.length) : p;
+}
+/**
+ * Return the set of possible resolution targets for a relative import
+ * specifier (already joined+normalized). For './foo' we yield:
+ *   foo, foo.ts, foo.tsx, foo.js, foo.jsx, foo.mjs, foo.cjs,
+ *   foo/index.ts, foo/index.tsx, foo/index.js, ...
+ */
+function resolutionCandidates(base) {
+    const exts = ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.mts', '.cts'];
+    const out = [base];
+    for (const ext of exts) {
+        out.push(base + ext);
+        out.push(base + '/index' + ext);
+    }
+    // Handle imports written with an explicit ".js" that actually resolve to a .ts file (ESM+NodeNext)
+    if (base.endsWith('.js')) {
+        const noJs = base.slice(0, -3);
+        out.push(noJs + '.ts', noJs + '.tsx');
+    }
+    return out;
+}
+async function loadPublicEntries(rootPath) {
+    const entries = new Set();
+    const pkgPath = path.join(rootPath, 'package.json');
+    try {
+        const raw = await fs.readFile(pkgPath, 'utf-8');
+        const pkg = JSON.parse(raw);
+        for (const value of [pkg.main, pkg.types, pkg.typings]) {
+            if (typeof value === 'string')
+                addNormalized(entries, value);
+        }
+        if (typeof pkg.bin === 'string')
+            addNormalized(entries, pkg.bin);
+        else if (pkg.bin && typeof pkg.bin === 'object') {
+            for (const value of Object.values(pkg.bin))
+                addNormalized(entries, value);
+        }
+        collectExports(pkg.exports, entries);
+    }
+    catch {
+        // package.json missing/unreadable — don't guard, every file is a candidate
+    }
+    return entries;
+}
+function addNormalized(set, value) {
+    const cleaned = value.replace(/^\.\//, '').replace(/^\//, '');
+    set.add(cleaned);
+    set.add(stripExtension(cleaned));
+}
+function collectExports(exportsField, out) {
+    if (!exportsField)
+        return;
+    if (typeof exportsField === 'string') {
+        addNormalized(out, exportsField);
+        return;
+    }
+    if (typeof exportsField !== 'object')
+        return;
+    for (const value of Object.values(exportsField)) {
+        collectExports(value, out);
+    }
+}
+//# sourceMappingURL=deadCodeCheck.js.map

package/dist/analyzers/deadCodeCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deadCodeCheck.js","sourceRoot":"","sources":["../../src/analyzers/deadCodeCheck.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAElG,sDAAsD;AACtD,MAAM,oBAAoB,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AAWrD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,QAAgB,EAAE,KAAkB;IAC9D,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5E,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAE5D,4EAA4E;IAC5E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACvD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3E,KAAK,MAAM,SAAS,IAAI,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QAC5C,IAAI,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QAC9C,IAAI,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC;YAAE,SAAS;QAC9D,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QACrD,IAAI,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAE,SAAS;QAErE,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QACpG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEnC,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,kBAAkB,IAAI,CAAC,YAAY,EAAE;YACzC,KAAK,EAAE,qBAAqB,IAAI,CAAC,YAAY,EAAE;YAC/C,WAAW,EAAE,GAAG,OAAO,CAAC,MAAM,gBAAgB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO;iBACtF,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBAClB,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,+EAA+E;YACrJ,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,YAAoB;IACtC,OAAO,CACL,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/B,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/B,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;QAClC,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,YAAoB;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,KAAK,OAAO,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,YAAoB,EAAE,aAA0B;IACrE,IAAI,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;QAC1C,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QACrB,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,QAAQ,GAAG,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,mGAAmG;IACnG,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;QAC9C,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAAE,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;aAC5D,IAAI,GAAG,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,GAAgB,EAAE,KAAa;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,YAAqB,EAAE,GAAgB;IAC7D,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,aAAa,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IACD,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,YAAuC,CAAC,EAAE,CAAC;QAC3E,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC"}

package/dist/analyzers/dependencyRiskCheck.js

@@ -1,17 +1,36 @@
 import { analyzeDependencies } from '../core/dependencyAnalyzer.js';
+import { findDependencyLines } from '../utils/packageJsonLocator.js';
+const PROJECT_LEVEL_RISKS = new Set([
+    'excessive-dependencies',
+    'many-dependencies',
+    'no-lockfile',
+]);
 export async function check(rootPath, _files) {
     const report = await analyzeDependencies(rootPath);
     if (!report)
         return [];
-    return report.risks.map((risk) => ({
-        id: `dep-risk-${risk.name}`,
-        title: risk.name === 'excessive-dependencies' || risk.name === 'many-dependencies' || risk.name === 'no-lockfile'
-            ? risk.reason
-            : `Dependency risk: ${risk.name}`,
-        description: risk.reason,
-        severity: risk.severity === 'high' ? 'error' : risk.severity === 'medium' ? 'warning' : 'info',
-        category: 'dependencies',
-        fixAvailable: false,
-    }));
+    const locations = await findDependencyLines(rootPath);
+    return report.risks.map((risk) => {
+        const isProjectLevel = PROJECT_LEVEL_RISKS.has(risk.name);
+        const line = !isProjectLevel ? locations?.lineOfDependency.get(risk.name) : undefined;
+        const issueLocations = isProjectLevel
+            ? [{ file: 'package.json' }]
+            : line
+                ? [{ file: 'package.json', line }]
+                : [{ file: 'package.json' }];
+        return {
+            id: `dep-risk-${risk.name}`,
+            title: isProjectLevel ? risk.reason : `Dependency risk: ${risk.name}`,
+            description: risk.reason,
+            severity: risk.severity === 'high'
+                ? 'error'
+                : risk.severity === 'medium'
+                    ? 'warning'
+                    : 'info',
+            category: 'dependencies',
+            fixAvailable: false,
+            locations: issueLocations,
+        };
+    });
 }
 //# sourceMappingURL=dependencyRiskCheck.js.map

package/dist/analyzers/dependencyRiskCheck.js.map

@@ -1 +1 @@
-{"version":3,"file":"dependencyRiskCheck.js","sourceRoot":"","sources":["../../src/analyzers/dependencyRiskCheck.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAGpE,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,QAAgB,EAAE,MAAmB;IAC/D,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjC,EAAE,EAAE,YAAY,IAAI,CAAC,IAAI,EAAE;QAC3B,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,wBAAwB,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;YAC/G,CAAC,CAAC,IAAI,CAAC,MAAM;YACb,CAAC,CAAC,oBAAoB,IAAI,CAAC,IAAI,EAAE;QACnC,WAAW,EAAE,IAAI,CAAC,MAAM;QACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,OAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAkB,CAAC,CAAC,CAAC,MAAe;QACzH,QAAQ,EAAE,cAAc;QACxB,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC,CAAC;AACN,CAAC"}
+{"version":3,"file":"dependencyRiskCheck.js","sourceRoot":"","sources":["../../src/analyzers/dependencyRiskCheck.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAGrE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,wBAAwB;IACxB,mBAAmB;IACnB,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,QAAgB,EAAE,MAAmB;IAC/D,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAEtD,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAS,EAAE;QACtC,MAAM,cAAc,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,MAAM,cAAc,GAAgC,cAAc;YAChE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YAC5B,CAAC,CAAC,IAAI;gBACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;gBAClC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAEjC,OAAO;YACL,EAAE,EAAE,YAAY,IAAI,CAAC,IAAI,EAAE;YAC3B,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,IAAI,EAAE;YACrE,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,QAAQ,EACN,IAAI,CAAC,QAAQ,KAAK,MAAM;gBACtB,CAAC,CAAE,OAAiB;gBACpB,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ;oBAC1B,CAAC,CAAE,SAAmB;oBACtB,CAAC,CAAE,MAAgB;YACzB,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,cAAc;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/analyzers/unusedDependencyCheck.d.ts

@@ -0,0 +1,2 @@
+import type { FileEntry, Issue } from '../types.js';
+export declare function check(rootPath: string, files: FileEntry[]): Promise<Issue[]>;

package/dist/analyzers/unusedDependencyCheck.js

@@ -0,0 +1,144 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { buildImportGraph } from '../core/importGraph.js';
+import { findDependencyLines } from '../utils/packageJsonLocator.js';
+/**
+ * Patterns for packages that are typically not imported directly from source
+ * but are still legitimately used (plugins, configs, types, peer tooling).
+ * Without this allowlist we'd flag everything in devDependencies.
+ */
+const IMPLICIT_USE_PREFIXES = [
+    '@types/',
+    'eslint-plugin-',
+    'eslint-config-',
+    'prettier-plugin-',
+    'postcss-plugin-',
+    'rollup-plugin-',
+    'vite-plugin-',
+    'babel-plugin-',
+    'babel-preset-',
+    'stylelint-plugin-',
+    'stylelint-config-',
+];
+const IMPLICIT_USE_EXACT = new Set([
+    'typescript',
+    'ts-node',
+    'tsx',
+    'tsup',
+    'esbuild',
+    'vite',
+    'webpack',
+    'rollup',
+    'parcel',
+    'eslint',
+    'prettier',
+    'stylelint',
+    'husky',
+    'lint-staged',
+    'commitlint',
+    '@commitlint/config-conventional',
+    'semantic-release',
+    'nx',
+    'lerna',
+    'rimraf',
+    'cross-env',
+    'concurrently',
+    'nodemon',
+    'npm-run-all',
+    'only-allow',
+    'zx',
+    'chokidar',
+    'react-scripts',
+    'next',
+    'nuxt',
+    'vitest',
+    'jest',
+    'mocha',
+    'ava',
+    'tap',
+    'jasmine',
+    '@playwright/test',
+    'cypress',
+    'storybook',
+    '@storybook/react',
+]);
+function isImplicitlyUsed(pkg) {
+    if (IMPLICIT_USE_EXACT.has(pkg))
+        return true;
+    return IMPLICIT_USE_PREFIXES.some((prefix) => pkg.startsWith(prefix));
+}
+export async function check(rootPath, files) {
+    const pkgPath = path.join(rootPath, 'package.json');
+    let raw;
+    try {
+        raw = await fs.readFile(pkgPath, 'utf-8');
+    }
+    catch {
+        return [];
+    }
+    let pkg;
+    try {
+        pkg = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    const dependencies = (pkg.dependencies ?? {});
+    const devDependencies = (pkg.devDependencies ?? {});
+    const allDeclared = new Set([...Object.keys(dependencies), ...Object.keys(devDependencies)]);
+    if (allDeclared.size === 0)
+        return [];
+    const graph = await buildImportGraph(rootPath, files);
+    // Also treat packages invoked from package.json scripts as used.
+    // e.g., "build": "tsc" means we should not flag typescript.
+    const scriptUsedBinaries = extractScriptBinaries(pkg);
+    const locations = await findDependencyLines(rootPath);
+    const unused = [];
+    for (const name of allDeclared) {
+        if (graph.externalPackages.has(name))
+            continue;
+        if (isImplicitlyUsed(name))
+            continue;
+        if (scriptUsedBinaries.has(name))
+            continue;
+        // skip scoped bin lookups (e.g., "npx some-tool") — covered by scriptUsedBinaries
+        const isDev = name in devDependencies;
+        const line = locations?.lineOfDependency.get(name);
+        unused.push({
+            id: `unused-dependency-${name}`,
+            title: `Unused ${isDev ? 'dev' : ''} dependency: ${name}`.replace('  ', ' ').trim(),
+            description: `The package "${name}" is declared in package.json but never imported from source. If it's used only in package.json scripts or as a plugin, add it to the projscan allowlist via .projscanrc → disableRules.`,
+            severity: isDev ? 'info' : 'warning',
+            category: 'dependencies',
+            fixAvailable: false,
+            locations: locations
+                ? [
+                    {
+                        file: 'package.json',
+                        line: line ?? 1,
+                    },
+                ]
+                : undefined,
+        });
+    }
+    return unused;
+}
+function extractScriptBinaries(pkg) {
+    const scripts = (pkg.scripts ?? {});
+    const bins = new Set();
+    for (const value of Object.values(scripts)) {
+        for (const token of value.split(/[\s&|;]+/)) {
+            if (!token)
+                continue;
+            if (token.startsWith('-'))
+                continue;
+            if (token.includes('/') || token.includes('\\'))
+                continue;
+            if (!/^[@\w][\w@\-/]*$/.test(token))
+                continue;
+            bins.add(token);
+        }
+    }
+    return bins;
+}
+//# sourceMappingURL=unusedDependencyCheck.js.map

package/dist/analyzers/unusedDependencyCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unusedDependencyCheck.js","sourceRoot":"","sources":["../../src/analyzers/unusedDependencyCheck.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE;;;;GAIG;AACH,MAAM,qBAAqB,GAAG;IAC5B,SAAS;IACT,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,eAAe;IACf,mBAAmB;IACnB,mBAAmB;CACpB,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,YAAY;IACZ,SAAS;IACT,KAAK;IACL,MAAM;IACN,SAAS;IACT,MAAM;IACN,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,WAAW;IACX,OAAO;IACP,aAAa;IACb,YAAY;IACZ,iCAAiC;IACjC,kBAAkB;IAClB,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,WAAW;IACX,cAAc;IACd,SAAS;IACT,aAAa;IACb,YAAY;IACZ,IAAI;IACJ,UAAU;IACV,eAAe;IACf,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,OAAO;IACP,KAAK;IACL,KAAK;IACL,SAAS;IACT,kBAAkB;IAClB,SAAS;IACT,WAAW;IACX,kBAAkB;CACnB,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,QAAgB,EAAE,KAAkB;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAA2B,CAAC;IACxE,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAA2B,CAAC;IAC9E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC7F,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAEtD,iEAAiE;IACjE,4DAA4D;IAC5D,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAEtD,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/C,IAAI,gBAAgB,CAAC,IAAI,CAAC;YAAE,SAAS;QACrC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3C,kFAAkF;QAElF,MAAM,KAAK,GAAG,IAAI,IAAI,eAAe,CAAC;QACtC,MAAM,IAAI,GAAG,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEnD,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,qBAAqB,IAAI,EAAE;YAC/B,KAAK,EAAE,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,gBAAgB,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE;YACnF,WAAW,EAAE,gBAAgB,IAAI,0LAA0L;YAC3N,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACpC,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,SAAS;gBAClB,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,cAAc;wBACpB,IAAI,EAAE,IAAI,IAAI,CAAC;qBAChB;iBACF;gBACH,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,GAA4B;IACzD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAA2B,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC9C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}