- Deliver offline-safe Deno analyzer (lockfile/import graph/runtime signals) that matches Ruby/PHP parity bar.
- Provide deterministic SBOM/inventory outputs and capability signals consumable by Policy/Surface.
deno.json / deno.jsonc (tasks, import map refs, npm bridging).deno.lock v2/v3 (modules, npm section, integrity hashes).- Optional
import_map.json; vendor/cache roots ($DENO_DIR, vendor/). - CLI flags via Surface.Env:
deno.disable_npm, deno.vendor, deno.lock_path, deno.import_map.
- Normalize config: parse
deno.json/jsonc; resolve importMap path; default to repo root import map if present. Sort keys. - Lock resolver: read
deno.lock; emit components:npm: entries → PURL (pkg:npm/<name>@<version>) + integrity from integrity.specifiers → source→target map for transitive graph.modules (remote URLs) → canonical URL + content hash when present; mark fetchSource: cache.
- Import map & vendor:
- Apply
imports/scopes to rewrite edges before graph emission. - If
vendor/ exists, prefer vendored paths; emit provenance: vendor.
- Graph builder:
- Build module graph from
specifiers + import map rewrites; emit edges (from -> to, kind: import|dynamic|npm). - Recognise
npm: specifiers; map to npm package node. - Stable ordering: sort by
from, to.
- Runtime/capability signals:
- Detect permissions from
tasks (--allow-* flags) and deno.json unstable/no-check. - Capture
nodeModulesDir toggle to flag npm bridge.
- Outputs:
- Inventory: npm components + remote module list (
digest, source, origin). - Graph: edges with provenance (
lockfile, import_map, vendor). - Signals:
deno.permissions[], deno.node_compat, deno.unstable.
- Add fixtures under
src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Deno.Tests/Fixtures/:- lockfile v2 + import map,
- lockfile v3 with npm section,
- vendorized project (
vendor/ present).
- Determinism assertions: sorted edges, stable hash of inventory, no network calls (enforce via stubbed fetcher).
- Analyzer implementation + tests in
StellaOps.Scanner.Analyzers.Lang.Deno. - Doc cross-link to
docs/modules/scanner/implementation_plan.md and sprint log. - Offline posture: default
LIVE_FETCH=false equivalent; rely solely on lock/import map/vendor.