feat: add --production flag to skip devDependencies

[mcmxcdev]

Summary

• Adds a --production boolean CLI flag to the analyze command
• When set, devDependencies are excluded from all three analyzers:
  • core-js: skips detection of core-js/core-js-pure in devDeps
  • dependencies: reports development: 0 for the dependency count stat
  • duplicate-dependencies: performs a BFS from production roots to collect only production-reachable packages, then filters both resolveDuplicateDependencies and computeParents accordingly
• New tests cover all three analyzers for the --production path

Closes #193

Test plan

• npm test — all 87 tests pass
• --production flag skips core-js in devDependencies
• --production flag zeroes out the development dependency count
• --production flag excludes duplicates only reachable through devDependency parents

🤖 Generated with Claude Code

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@e18e/cli@238

commit: 1505ea2

[github-actions]

⚠️ Dependency Count

This PR adds 10 new dependencies (219 → 229), which exceeds the threshold of 10.

⚠️ Duplicate Dependencies (found: 13, threshold: 1)

📦 Package	📋 Versions
@ast-grep/napi	2 versions @e18e/cli@0.0.1 @e18e/web-features-codemods@0.2.0 @ast-grep/napi@0.40.5 @e18e/cli@0.0.1 module-replacements-codemods@2.0.0 @ast-grep/napi@0.42.3
@ast-grep/napi-darwin-arm64	2 versions @e18e/cli@0.0.1 @e18e/web-features-codemods@0.2.0 @ast-grep/napi@0.40.5 @ast-grep/napi-darwin-arm64@0.40.5 @e18e/cli@0.0.1 module-replacements-codemods@2.0.0 @ast-grep/napi@0.42.3 @ast-grep/napi-darwin-arm64@0.42.3
@ast-grep/napi-darwin-x64	2 versions @e18e/cli@0.0.1 @e18e/web-features-codemods@0.2.0 @ast-grep/napi@0.40.5 @ast-grep/napi-darwin-x64@0.40.5 @e18e/cli@0.0.1 module-replacements-codemods@2.0.0 @ast-grep/napi@0.42.3 @ast-grep/napi-darwin-x64@0.42.3
@ast-grep/napi-linux-arm64-gnu	2 versions @e18e/cli@0.0.1 @e18e/web-features-codemods@0.2.0 @ast-grep/napi@0.40.5 @ast-grep/napi-linux-arm64-gnu@0.40.5 @e18e/cli@0.0.1 module-replacements-codemods@2.0.0 @ast-grep/napi@0.42.3 @ast-grep/napi-linux-arm64-gnu@0.42.3
@ast-grep/napi-linux-arm64-musl	2 versions @e18e/cli@0.0.1 @e18e/web-features-codemods@0.2.0 @ast-grep/napi@0.40.5 @ast-grep/napi-linux-arm64-musl@0.40.5 @e18e/cli@0.0.1 module-replacements-codemods@2.0.0 @ast-grep/napi@0.42.3 @ast-grep/napi-linux-arm64-musl@0.42.3
@ast-grep/napi-linux-x64-gnu	2 versions @e18e/cli@0.0.1 @e18e/web-features-codemods@0.2.0 @ast-grep/napi@0.40.5 @ast-grep/napi-linux-x64-gnu@0.40.5 @e18e/cli@0.0.1 module-replacements-codemods@2.0.0 @ast-grep/napi@0.42.3 @ast-grep/napi-linux-x64-gnu@0.42.3
@ast-grep/napi-linux-x64-musl	2 versions @e18e/cli@0.0.1 @e18e/web-features-codemods@0.2.0 @ast-grep/napi@0.40.5 @ast-grep/napi-linux-x64-musl@0.40.5 @e18e/cli@0.0.1 module-replacements-codemods@2.0.0 @ast-grep/napi@0.42.3 @ast-grep/napi-linux-x64-musl@0.42.3
@ast-grep/napi-win32-arm64-msvc	2 versions @e18e/cli@0.0.1 @e18e/web-features-codemods@0.2.0 @ast-grep/napi@0.40.5 @ast-grep/napi-win32-arm64-msvc@0.40.5 @e18e/cli@0.0.1 module-replacements-codemods@2.0.0 @ast-grep/napi@0.42.3 @ast-grep/napi-win32-arm64-msvc@0.42.3
@ast-grep/napi-win32-ia32-msvc	2 versions @e18e/cli@0.0.1 @e18e/web-features-codemods@0.2.0 @ast-grep/napi@0.40.5 @ast-grep/napi-win32-ia32-msvc@0.40.5 @e18e/cli@0.0.1 module-replacements-codemods@2.0.0 @ast-grep/napi@0.42.3 @ast-grep/napi-win32-ia32-msvc@0.42.3
@ast-grep/napi-win32-x64-msvc	2 versions @e18e/cli@0.0.1 @e18e/web-features-codemods@0.2.0 @ast-grep/napi@0.40.5 @ast-grep/napi-win32-x64-msvc@0.40.5 @e18e/cli@0.0.1 module-replacements-codemods@2.0.0 @ast-grep/napi@0.42.3 @ast-grep/napi-win32-x64-msvc@0.42.3
eslint-visitor-keys	2 versions @e18e/cli@0.0.1 eslint@10.4.1 @eslint-community/eslint-utils@4.9.1 eslint-visitor-keys@3.4.3 @e18e/cli@0.0.1 eslint@10.4.1 eslint-visitor-keys@5.0.1
@humanwhocodes/retry	2 versions @e18e/cli@0.0.1 eslint@10.4.1 @humanfs/node@0.16.6 @humanwhocodes/retry@0.3.1 @e18e/cli@0.0.1 eslint@10.4.1 @humanwhocodes/retry@0.4.3
ignore	2 versions @e18e/cli@0.0.1 eslint@10.4.1 ignore@5.3.2 @e18e/cli@0.0.1 typescript-eslint@8.60.1 @typescript-eslint/eslint-plugin@8.60.1 ignore@7.0.5

💡 To find out what depends on a specific package, run: npm ls example-package

📊 Dependency Size Changes

Warning

This PR adds 8.1 MB of new dependencies, which exceeds the threshold of 100 kB.

📦 Package	📏 Size
@ast-grep/napi-linux-x64-gnu@0.43.0	-7.8 MB
@ast-grep/napi-linux-x64-gnu@0.42.3	7.8 MB
@ast-grep/napi-linux-x64-gnu@0.40.5	7.7 MB
@ast-grep/napi@0.42.3	360.7 kB
@ast-grep/napi@0.43.0	-360.7 kB
@ast-grep/napi@0.40.5	346.8 kB
gunshi@0.35.1 → gunshi@0.33.0	-7.2 kB
@typescript-eslint/typescript-estree@8.61.0 → @typescript-eslint/typescript-estree@8.60.1	-419 B
@e18e/web-features-codemods@0.2.2 → @e18e/web-features-codemods@0.2.0	-159 B
semver@7.8.4 → semver@7.8.2	-153 B
prettier@3.8.4 → prettier@3.8.3	-138 B
eslint@10.5.0 → eslint@10.4.1	-88 B
@typescript-eslint/eslint-plugin@8.61.0 → @typescript-eslint/eslint-plugin@8.60.1	47 B
@types/node@25.9.3 → @types/node@25.9.2	-42 B
obug@2.1.3 → obug@2.1.2	-24 B
@typescript-eslint/parser@8.61.0 → @typescript-eslint/parser@8.60.1	0 B
@typescript-eslint/project-service@8.61.0 → @typescript-eslint/project-service@8.60.1	0 B
@typescript-eslint/scope-manager@8.61.0 → @typescript-eslint/scope-manager@8.60.1	0 B
@typescript-eslint/tsconfig-utils@8.61.0 → @typescript-eslint/tsconfig-utils@8.60.1	0 B
@typescript-eslint/type-utils@8.61.0 → @typescript-eslint/type-utils@8.60.1	0 B
@typescript-eslint/types@8.61.0 → @typescript-eslint/types@8.60.1	0 B
@typescript-eslint/utils@8.61.0 → @typescript-eslint/utils@8.60.1	0 B
@typescript-eslint/visitor-keys@8.61.0 → @typescript-eslint/visitor-keys@8.60.1	0 B
module-replacements-codemods@2.0.1 → module-replacements-codemods@2.0.0	0 B
typescript-eslint@8.61.0 → typescript-eslint@8.60.1	0 B

Total size change: 8.1 MB

⚠️ Package Trust Level Decreased

Caution

Decreased trust levels may indicate a higher risk of supply chain attacks. Please review these changes carefully.

📦 Package	🔒 Before	🔓 After
@e18e/web-features-codemods	stagedPublish	trustedPublisher

[dreyfus92]

hey @mcmxcdev thank you for working on this, left a few comments ✌🏻

[dreyfus92]

this is a bit misleading, the filter matches by identity, not by name@version key like the comment says (and it contradicts the note in collectProductionReachable). worth rewording to something like "only packages present in this set (by reference) are considered"

[dreyfus92]

these tests are alright, but they never run a real lockfile thru lockparse. that means they just validate filtering logic but would not catch a regression where lockparse stops sharing refs. it would be nice to have a fixture-based test that parses an actual lockfile with --production set, to pin the contract down.