fix(tarball): unused dependency false positive

.changeset/fluffy-frogs-shop.md

@@ -0,0 +1,5 @@
+---
+"@nodesecure/tarball": patch
+---
+
+fix(tarball): unused dependency false positive

workspaces/tarball/src/class/DependencyCollectableSet.class.ts

@@ -217,9 +217,7 @@ export class DependencyCollectableSet implements CollectableSet<Metadata> {
       }
     }
 
-    const name = dependencies.includes(sourceDependency) ?
-      sourceDependency :
-      parseNpmSpec(sourceDependency)?.name ?? sourceDependency;
+    const name = this.#extractDependencyName(sourceDependency, dependencies);
 
     let thirdPartyDependency: string | undefined;
 
@@ -253,6 +251,20 @@ export class DependencyCollectableSet implements CollectableSet<Metadata> {
     }
   }
 
+  #extractDependencyName(sourceDependency: string, dependencies: string[]) {
+    for (const dependency of dependencies) {
+      if (dependency === sourceDependency) {
+        return sourceDependency;
+      }
+
+      if (sourceDependency.startsWith(dependency)) {
+        return dependency;
+      }
+    }
+
+    return parseNpmSpec(sourceDependency)?.name ?? sourceDependency;
+  }
+
   #isMissingDependency(thirdPartyDependency: string, thirdPartyAliasedDependency: string | undefined) {
     const { dependencies, nodejsImports = {} } = this.#mama;
 

workspaces/tarball/test/DependencyCollectableSet.spec.ts

@@ -263,6 +263,51 @@ describe("DependencyCollectableSet", () => {
     });
   });
 
+  test("should not detect unused dependencies on deep import", () => {
+    const mama = {
+      dependencies: ["koa", "kleur"],
+      devDependencies: ["mocha"]
+    };
+    const dependencyCollectableSet = new DependencyCollectableSet(mama);
+
+    dependencyCollectableSet.add("mocha", {
+      file: process.cwd(), location: [[0, 0], [0, 0]], metadata: {
+        unsafe: false,
+        inTry: false,
+        relativeFile: process.cwd()
+      }
+    });
+
+    dependencyCollectableSet.add("kleur", {
+      file: process.cwd(), location: [[0, 0], [0, 0]], metadata: {
+        unsafe: false,
+        inTry: false,
+        relativeFile: process.cwd()
+      }
+    });
+
+    dependencyCollectableSet.add("koa/dist/index.js", {
+      file: process.cwd(), location: [[0, 0], [0, 0]], metadata: {
+        unsafe: false,
+        inTry: false,
+        relativeFile: process.cwd()
+      }
+    });
+
+    assert.deepEqual(dependencyCollectableSet.extract(), {
+      files: new Set([]),
+      dependenciesInTryBlock: [],
+      flags: { hasExternalCapacity: false, hasMissingOrUnusedDependency: false },
+      dependencies: {
+        nodeJs: [],
+        thirdparty: ["kleur", "koa"],
+        subpathImports: {},
+        unused: [],
+        missing: []
+      }
+    });
+  });
+
   test("should be capable of detecting missing dependency 'kleur'", () => {
     const mama = {
       dependencies: ["mocha"],