build: add knip to find unused files, exports and dependencies

.github/workflows/ci.yml

@@ -86,8 +86,10 @@ jobs:
           # no npm cache: npm ci takes seconds, and devEngines in package.json would
           # otherwise switch one on
           package-manager-cache: false
+      # knip needs every workspace's dependencies to match binaries like c8
+      # in their scripts to the packages that provide them
       - name: Run npm ci
-        run: npm ci --workspaces=false
+        run: npm ci
       - name: Run npm lint
         run: npm run lint
       # npm rejects a provenance publish when repository.url doesn't match the

README.md

@@ -23,7 +23,7 @@ nodevu is composed of a set of modules:
 Installing needs npm 11.17 or newer, which ships with Node.js 24 and later. `.npmrc` skips packages published in the last 3 days and blocks git and URL dependencies. npm only runs the dependency install scripts that `allowScripts` in `package.json` approves, and `npm approve-scripts <pkg>` adds one pinned to its installed version.
 
 - `npm test` and `npm run coverage` run every module's tests.
-- `npm run lint` checks the whole repo with oxlint and oxfmt, and checks with [docov](https://github.com/cutenode/docov) that everything the modules export has JSDoc. `docov.jsonc` sets what it scans. `npm run lint:harden` tests `tools/harden/` and runs [@lavamoat/harden](https://github.com/LavaMoat/LavaMoat/tree/main/packages/harden) to check that `.npmrc` and `package.json` keep every hardening setting, except the ones `tools/harden/decisions.json` turns off.
+- `npm run lint` checks the whole repo with oxlint and oxfmt, and checks with [docov](https://github.com/cutenode/docov) that everything the modules export has JSDoc. `docov.jsonc` sets what it scans. `npm run lint:harden` tests `tools/harden/` and runs [@lavamoat/harden](https://github.com/LavaMoat/LavaMoat/tree/main/packages/harden) to check that `.npmrc` and `package.json` keep every hardening setting, except the ones `tools/harden/decisions.json` turns off. `npm run knip` runs [knip](https://knip.dev) to find unused files, exports and dependencies. `knip.jsonc` lists what it skips and why. `npm run lint` runs both.
 - `npm run types` type-checks the JSDoc and writes each module's TypeScript declarations to its `types/` folder. Commit them: CI fails when they're out of date.
 - `npm run docs:dev` builds the docs from `docs/pages/` with [doc-kit](https://doc-kit.nodejs.org/) and serves them locally. `npm run docs` only builds them, into `out/`.
 

knip.jsonc

@@ -0,0 +1,34 @@
+{
+	"$schema": "./node_modules/knip/schema-jsonc.json",
+	"ignore": [
+		// generated from the JSDoc by `npm run types` and published through
+		// each package's `types` field
+		"*/types/**",
+		// vendored oxlint plugin
+		"tools/oxlint/anti-slop/**",
+	],
+	"workspaces": {
+		".": {
+			// `doc-kit generate` loads its config by name, and the config points
+			// doc-kit at the theme by path
+			"entry": ["doc-kit.config.mjs", "docs/theme/Navigation.jsx"],
+			"ignoreDependencies": [
+				// test/types.mts checks the published types through the workspace links
+				"^@nodevu/",
+				// only a JSDoc type in doc-kit.config.mjs, installed by @doc-kit/cli
+				"@doc-kit/core",
+			],
+			// aliases doc-kit's React generator defines while it builds the site
+			"ignoreUnresolved": ["^#theme/"],
+		},
+		"fetchindex": {
+			// the tests require core's optionsParser, which requires luxon, and CI
+			// installs only this workspace's dependencies
+			"ignoreDependencies": ["luxon"],
+		},
+		"static": {
+			// the build test resolves core's own luxon to stop core's clock
+			"ignoreDependencies": ["luxon"],
+		},
+	},
+}