fix(cli,build): correct warning suppression sources and harden the scanner

Deploy suppression now uses only the manifest externals (the actual image
contents when the warning runs); configured externals like build.external
no longer silence warnings for packages that are never installed. Dev
suppression adds extension-declared packages and stays silent when those
can't be determined (a hook throws, or an older additionalPackages lacks
the declaration hook), so it never makes a false deploys-will-fail claim,
and additionalPackages skips unparseable entries instead of throwing into
dev startup. The lexer blanks regex-literal bodies and records quoted
string spans so string contents can't false-positive, dynamic
import("node:module") bindings and declare-then-assign variables are
recognized, require functions exported from one file and imported into
another are followed, dev rebuilds cache per-file scans by mtime and stat
in parallel, and the dev/deploy pipelines share one warning builder.

Author: matt-aitken

packages/cli-v3/src/dev/devSession.ts

@@ -15,15 +15,11 @@ import {
   notifyExtensionOnBuildStart,
   resolvePluginsForContext,
 } from "../build/extensions.js";
+import { createExternalsBuildExtension, resolveAlwaysExternal } from "../build/externals.js";
 import {
-  createExternalsBuildExtension,
-  deployExternalMatchers,
-  resolveAlwaysExternal,
-} from "../build/externals.js";
-import {
+  collectCreateRequireWarningMessages,
   CreateRequireCollector,
-  createRequireUsageToWarning,
-  unavailableCreateRequireUsages,
+  extensionInstalledPackageMatchers,
 } from "../build/createRequireWarnings.js";
 import { type DevCommandOptions } from "../commands/dev.js";
 import { eventBus } from "../utilities/eventBus.js";
@@ -93,7 +89,7 @@ export async function startDevSession({
 
   const externalsExtension = createExternalsBuildExtension("dev", rawConfig, alwaysExternal);
   const createRequireCollector = new CreateRequireCollector(rawConfig.workingDir);
-  const externalMatchers = deployExternalMatchers(rawConfig, alwaysExternal);
+  const extensionPackages = extensionInstalledPackageMatchers(rawConfig);
   const buildContext = createBuildContext("dev", rawConfig);
   buildContext.prependExtension(externalsExtension);
   await notifyExtensionOnBuildStart(buildContext);
@@ -126,16 +122,15 @@ export async function startDevSession({
 
     buildManifest = await notifyExtensionOnBuildComplete(buildContext, buildManifest);
 
-    const missingWhenDeployed = unavailableCreateRequireUsages(
-      createRequireCollector.usages,
-      new Set((buildManifest.externals ?? []).map((external) => external.name)),
-      externalMatchers
-    );
+    const createRequireWarnings = collectCreateRequireWarningMessages({
+      usages: createRequireCollector.usages,
+      buildManifest,
+      extensionPackages,
+      target: "dev",
+    });
 
-    if (missingWhenDeployed.length > 0) {
-      logBuildWarnings(
-        missingWhenDeployed.map((usage) => createRequireUsageToWarning(usage, "dev"))
-      );
+    if (createRequireWarnings.length > 0) {
+      logBuildWarnings(createRequireWarnings);
     }
 
     try {