45 lines
2.5 KiB
Markdown
45 lines
2.5 KiB
Markdown
# Deno Analyzer Scope · SCANNER-ENG-0011 (2025-12-08)
|
|
|
|
## Goals
|
|
- Deliver offline-safe Deno analyzer (lockfile/import graph/runtime signals) that matches Ruby/PHP parity bar.
|
|
- Provide deterministic SBOM/inventory outputs and capability signals consumable by Policy/Surface.
|
|
|
|
## Inputs
|
|
- `deno.json` / `deno.jsonc` (tasks, import map refs, npm bridging).
|
|
- `deno.lock` v2/v3 (modules, npm section, integrity hashes).
|
|
- Optional `import_map.json`; vendor/cache roots (`$DENO_DIR`, `vendor/`).
|
|
- CLI flags via Surface.Env: `deno.disable_npm`, `deno.vendor`, `deno.lock_path`, `deno.import_map`.
|
|
|
|
## Pipeline (deterministic, offline)
|
|
1) **Normalize config**: parse `deno.json`/jsonc; resolve `importMap` path; default to repo root import map if present. Sort keys.
|
|
2) **Lock resolver**: read `deno.lock`; emit components:
|
|
- `npm:` entries → PURL (`pkg:npm/<name>@<version>`) + integrity from `integrity`.
|
|
- `specifiers` → source→target map for transitive graph.
|
|
- `modules` (remote URLs) → canonical URL + content hash when present; mark `fetchSource: cache`.
|
|
3) **Import map & vendor**:
|
|
- Apply `imports`/`scopes` to rewrite edges before graph emission.
|
|
- If `vendor/` exists, prefer vendored paths; emit `provenance: vendor`.
|
|
4) **Graph builder**:
|
|
- Build module graph from `specifiers` + import map rewrites; emit edges `(from -> to, kind: import|dynamic|npm)`.
|
|
- Recognise `npm:` specifiers; map to npm package node.
|
|
- Stable ordering: sort by `from, to`.
|
|
5) **Runtime/capability signals**:
|
|
- Detect permissions from `tasks` (`--allow-*` flags) and `deno.json` `unstable`/`no-check`.
|
|
- Capture `nodeModulesDir` toggle to flag npm bridge.
|
|
6) **Outputs**:
|
|
- Inventory: npm components + remote module list (`digest`, `source`, `origin`).
|
|
- Graph: edges with provenance (`lockfile`, `import_map`, `vendor`).
|
|
- Signals: `deno.permissions[]`, `deno.node_compat`, `deno.unstable`.
|
|
|
|
## Tests & fixtures
|
|
- Add fixtures under `src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Deno.Tests/Fixtures/`:
|
|
- lockfile v2 + import map,
|
|
- lockfile v3 with npm section,
|
|
- vendorized project (`vendor/` present).
|
|
- Determinism assertions: sorted edges, stable hash of inventory, no network calls (enforce via stubbed fetcher).
|
|
|
|
## Deliverables
|
|
- Analyzer implementation + tests in `StellaOps.Scanner.Analyzers.Lang.Deno`.
|
|
- Doc cross-link to `docs/modules/scanner/implementation_plan.md` and sprint log.
|
|
- Offline posture: default `LIVE_FETCH=false` equivalent; rely solely on lock/import map/vendor.
|