Deno Analyzer Scope · SCANNER-ENG-0011 (2025-12-08)

Goals

Deliver offline-safe Deno analyzer (lockfile/import graph/runtime signals) that matches Ruby/PHP parity bar.
Provide deterministic SBOM/inventory outputs and capability signals consumable by Policy/Surface.

deno.json / deno.jsonc (tasks, import map refs, npm bridging).
deno.lock v2/v3 (modules, npm section, integrity hashes).
Optional import_map.json; vendor/cache roots ($DENO_DIR, vendor/).
CLI flags via Surface.Env: deno.disable_npm, deno.vendor, deno.lock_path, deno.import_map.

Normalize config: parse deno.json/jsonc; resolve importMap path; default to repo root import map if present. Sort keys.
Lock resolver: read deno.lock; emit components:
- npm: entries → PURL (pkg:npm/<name>@<version>) + integrity from integrity.
- specifiers → source→target map for transitive graph.
- modules (remote URLs) → canonical URL + content hash when present; mark fetchSource: cache.
Import map & vendor:
- Apply imports/scopes to rewrite edges before graph emission.
- If vendor/ exists, prefer vendored paths; emit provenance: vendor.
Graph builder:
- Build module graph from specifiers + import map rewrites; emit edges (from -> to, kind: import|dynamic|npm).
- Recognise npm: specifiers; map to npm package node.
- Stable ordering: sort by from, to.
Runtime/capability signals:
- Detect permissions from tasks (--allow-* flags) and deno.json unstable/no-check.
- Capture nodeModulesDir toggle to flag npm bridge.
Outputs:
- Inventory: npm components + remote module list (digest, source, origin).
- Graph: edges with provenance (lockfile, import_map, vendor).
- Signals: deno.permissions[], deno.node_compat, deno.unstable.

Add fixtures under src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Deno.Tests/Fixtures/:
- lockfile v2 + import map,
- lockfile v3 with npm section,
- vendorized project (vendor/ present).
Determinism assertions: sorted edges, stable hash of inventory, no network calls (enforce via stubbed fetcher).

Analyzer implementation + tests in StellaOps.Scanner.Analyzers.Lang.Deno.
Doc cross-link to docs/modules/scanner/implementation_plan.md and sprint log.
Offline posture: default LIVE_FETCH=false equivalent; rely solely on lock/import map/vendor.