git.stella-ops.org/src/Scanner/StellaOps.Scanner.Analyzers.Lang.Deno/TASKS.md

Deno Analyzer Task Board

Imposed rule: work of this type or tasks of this type on this component — and everywhere else it should be applied.

Deno Entry-Point Analyzer (Sprint 49)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
SCANNER-ANALYZERS-DENO-26-001	TODO	Deno Analyzer Guild	SCANNER-ANALYZERS-LANG-10-309N	Build input normalizer & VFS for Deno projects: merge deno.json(c), import maps, lockfiles, vendor dirs, $DENO_DIR caches, and container layers. Detect runtime/toolchain hints deterministically.	Normalizer ingests fixtures (source+vendor, cache-only, container) without network; outputs config digest, import map, cache locations, and deterministic module root inventory.
SCANNER-ANALYZERS-DENO-26-002	TODO	Deno Analyzer Guild	SCANNER-ANALYZERS-DENO-26-001	Module graph builder: resolve static/dynamic imports using import map, deno.lock, vendor/, cache, npm bridge, node: builtins, WASM/JSON assertions. Annotate edges with resolution source and form.	Graph reconstruction succeeds on fixtures (vendor, cache-only, npm, remote). Edges include form, source, resolution (`vendor
SCANNER-ANALYZERS-DENO-26-003	TODO	Deno Analyzer Guild	SCANNER-ANALYZERS-DENO-26-002	NPM/Node compat adapter: map npm: specifiers to cached packages or compat node_modules, evaluate package exports/conditions, record node: builtin usage.	Fixtures with npm bridge resolve to cached/vendor modules; outputs include npm package metadata + node builtin list; unresolved npm deps flagged.
SCANNER-ANALYZERS-DENO-26-004	TODO	Deno Analyzer Guild	SCANNER-ANALYZERS-DENO-26-002	Static analyzer for permission/capability signals (FS, net, env, process, crypto, FFI, workers). Detect dynamic-import patterns, literal fetch URLs, tasks vs declared permissions.	Capability records emitted with evidence snippets; dynamic import warnings include pattern info; task vs inferred permission diffs reported.
SCANNER-ANALYZERS-DENO-26-005	TODO	Deno Analyzer Guild	SCANNER-ANALYZERS-DENO-26-002	Bundle/binary inspector: parse eszip bundles and deno compile executables (embedded eszip + snapshot) to recover module graph, config, embedded resources.	Bundle and compile fixtures yield recovered module lists, digests, and target metadata; compiled exe scanning <600ms; determinism verified.
SCANNER-ANALYZERS-DENO-26-006	TODO	Deno Analyzer Guild	SCANNER-ANALYZERS-DENO-26-002	Container adapter: traverse OCI layers for deno, caches, vendor directories, compiled binaries; merge module provenance with layer info.	Container fixtures output runtime version, cache roots, vendor mapping, binary metadata with layer provenance; determinism maintained.

Deno Observation & Runtime (Sprint 50)

ID	Status	Owner(s)	Depends on	Description	Exit Criteria
SCANNER-ANALYZERS-DENO-26-007	TODO	Deno Analyzer Guild	SCANNER-ANALYZERS-DENO-26-002	Produce AOC-compliant observations: entrypoints, modules, edges, permissions, workers, warnings, binaries with reason codes and contexts.	Observation JSON for fixtures deterministic; edges include form/source/reason; capabilities and permission drift recorded; passes AOC lint.
SCANNER-ANALYZERS-DENO-26-008	TODO	Deno Analyzer Guild, QA Guild	SCANNER-ANALYZERS-DENO-26-007	Fixture suite + performance benchmarks (vendor, npm, FFI, workers, dynamic import, bundle/binary, cache-only, container).	Fixture set under fixtures/lang/deno/ep; determinism and perf (<1.5s 2k-module graph) CI gates enabled.
SCANNER-ANALYZERS-DENO-26-009	TODO	Deno Analyzer Guild, Signals Guild	SCANNER-ANALYZERS-DENO-26-007	Optional runtime evidence hooks (loader/require shim) capturing module loads + permissions during harnessed execution with path hashing.	Runtime harness logs module loads for sample app with scrubbed paths; runtime edges merge without altering static precedence; privacy doc updated.
SCANNER-ANALYZERS-DENO-26-010	TODO	Deno Analyzer Guild, DevOps Guild	SCANNER-ANALYZERS-DENO-26-007	Package analyzer plug-in, add CLI (`stella deno inspect	resolve
SCANNER-ANALYZERS-DENO-26-011	TODO	Deno Analyzer Guild	SCANNER-ANALYZERS-DENO-26-004	Policy signal emitter: net/fs/env/ffi/process/crypto capabilities, remote origin list, npm usage, wasm modules, dynamic-import warnings.	Outputs include policy signal section consumed by tests; schema documented; sample policy evaluation validated.