feat: add core-js check

package.json

@@ -57,6 +57,7 @@
     "obug": "^2.1.1",
     "package-manager-detector": "^1.6.0",
     "publint": "^0.3.18",
+    "core-js-compat": "^3.48.0",
     "semver": "^7.7.4",
     "tinyglobby": "^0.2.16"
   },

src/analyze/core-js.ts

@@ -0,0 +1,98 @@
+import {glob} from 'tinyglobby';
+import {minVersion} from 'semver';
+import {relative, join} from 'path';
+import type {AnalysisContext, ReportPluginResult} from '../types.js';
+
+import coreJsCompat from 'core-js-compat';
+
+const BROAD_IMPORTS = new Set([
+  'core-js',
+  'core-js/stable',
+  'core-js/actual',
+  'core-js/full'
+]);
+
+const SOURCE_GLOB = ['**/*.{js,ts,mjs,cjs,jsx,tsx}'];
+const SOURCE_IGNORE = [
+  '**/node_modules/**',
+  '**/dist/**',
+  '**/build/**',
+  '**/coverage/**',
+  '**/lib/**'
+];
+
+const IMPORT_RE =
+  /(?:import\s+(?:.*\s+from\s+)?|require\s*\()\s*['"]([^'"]+)['"]/g;
+
+export async function runCoreJsAnalysis(
+  context: AnalysisContext
+): Promise<ReportPluginResult> {
+  const messages: ReportPluginResult['messages'] = [];
+  const pkg = context.packageFile;
+
+  const hasCoreJs =
+    'core-js' in (pkg.dependencies ?? {}) ||
+    'core-js' in (pkg.devDependencies ?? {}) ||
+    'core-js-pure' in (pkg.dependencies ?? {}) ||
+    'core-js-pure' in (pkg.devDependencies ?? {});
+
+  if (!hasCoreJs) {
+    return {messages};
+  }
+
+  const nodeRange = pkg.engines?.node;
+  let targetVersion = 'current';
+  if (nodeRange) {
+    const floor = minVersion(nodeRange);
+    if (floor) {
+      targetVersion = floor.version;
+    }
+  }
+
+  const {list: unnecessaryForTarget} = coreJsCompat.compat({
+    targets: {node: targetVersion},
+    inverse: true
+  });
+  const unnecessarySet = new Set(unnecessaryForTarget);
+
+  const srcGlobs = context.options?.src;
+  const patterns = srcGlobs && srcGlobs.length > 0 ? srcGlobs : SOURCE_GLOB;
+  const allFiles = await glob(patterns, {
+    cwd: context.root,
+    ignore: SOURCE_IGNORE
+  });
+  // filter out any paths that escaped context.root via ../
+  const files = allFiles.filter(
+    (f) => !relative(context.root, join(context.root, f)).startsWith('..')
+  );
+
+  for (const filePath of files) {
+    let source: string;
+    try {
+      source = await context.fs.readFile(filePath);
+    } catch {
+      continue;
+    }
+
+    for (const [, specifier] of source.matchAll(IMPORT_RE)) {
+      if (BROAD_IMPORTS.has(specifier)) {
+        messages.push({
+          severity: 'warning',
+          score: 0,
+          message: `Broad core-js import "${specifier}" in ${filePath} loads all polyfills at once. Import only the specific modules you need.`
+        });
+      } else if (specifier.startsWith('core-js/modules/')) {
+        const moduleName = specifier.slice('core-js/modules/'.length);
+        if (unnecessarySet.has(moduleName)) {
+          messages.push({
+            severity: 'suggestion',
+            score: 0,
+            message: `core-js polyfill "${moduleName}" imported in ${filePath} is unnecessary — your Node.js target (>= ${targetVersion}) already supports this natively.`
+          });
+        }
+      }
+    }
+  }
+
+  return {messages};
+}

src/analyze/report.ts

@@ -16,12 +16,14 @@ import {runPlugins} from '../plugin-runner.js';
 import {getPackageJson, detectLockfile} from '../utils/package-json.js';
 import {parse as parseLockfile} from 'lockparse';
 import {runDuplicateDependencyAnalysis} from './duplicate-dependencies.js';
+import {runCoreJsAnalysis} from './core-js.js';
 
 const plugins: ReportPlugin[] = [
   runPublint,
   runReplacements,
   runDependencyAnalysis,
-  runDuplicateDependencyAnalysis
+  runDuplicateDependencyAnalysis,
+  runCoreJsAnalysis
 ];
 
 async function computeInfo(fileSystem: FileSystem) {

src/commands/analyze.meta.ts

@@ -39,6 +39,12 @@ export const meta = {
       default: false,
       description:
         'Output results as JSON to stdout (messages follow --quiet or resolved --report-level)'
+    },
+    src: {
+      type: 'string',
+      multiple: true,
+      description:
+        'Glob pattern(s) for source files to scan for imports (e.g. "src/**/*.ts"). Defaults to scanning all JS/TS files from the project root.'
     }
   }
 } as const;

src/commands/analyze.ts

@@ -101,10 +101,12 @@ export async function run(ctx: CommandContext<typeof meta>) {
   }
 
   const customManifests = ctx.values['manifest'];
+  const srcDirs = ctx.values['src'];
 
   const {stats, messages} = await report({
     root,
     manifest: customManifests,
+    src: srcDirs,
     categories: parsedCategories
   });