@dep-radius/core 0.1.0

package/dist/registry/tar.js

@@ -0,0 +1,75 @@
+import { gunzipSync } from "node:zlib";
+// Reads a gzipped npm tarball in memory. Nothing touches the disk, so a hostile path cannot escape.
+// Ustar prefixes, pax `path` records and GNU long names are all read; strips the first path segment,
+// which npm writes as `package/` but some publishers name differently.
+export function readTarball(tgz, keep) {
+    const buf = gunzipSync(tgz);
+    const out = new Map();
+    let offset = 0;
+    let paxPath;
+    let longName;
+    while (offset + 512 <= buf.length) {
+        const header = buf.subarray(offset, offset + 512);
+        if (header.every((b) => b === 0))
+            break;
+        const name = cstr(header.subarray(0, 100));
+        const size = parseOctal(header.subarray(124, 136));
+        const type = String.fromCharCode(header[156] ?? 48);
+        const magic = cstr(header.subarray(257, 263));
+        const prefix = magic.startsWith("ustar")
+            ? cstr(header.subarray(345, 500))
+            : "";
+        const dataStart = offset + 512;
+        const data = buf.subarray(dataStart, dataStart + size);
+        offset = dataStart + Math.ceil(size / 512) * 512;
+        if (type === "x") {
+            paxPath = parsePax(data).path ?? paxPath;
+            continue;
+        }
+        if (type === "g")
+            continue;
+        if (type === "L") {
+            longName = cstr(data);
+            continue;
+        }
+        const full = paxPath ?? longName ?? (prefix ? `${prefix}/${name}` : name);
+        paxPath = undefined;
+        longName = undefined;
+        if (type !== "0" && type !== "\0" && type !== "7")
+            continue;
+        const rel = full.replace(/^\/+/, "").split("/").slice(1).join("/");
+        if (!rel || rel.split("/").includes(".."))
+            continue;
+        if (keep(rel))
+            out.set(rel, Buffer.from(data));
+    }
+    return out;
+}
+function cstr(b) {
+    const end = b.indexOf(0);
+    return Buffer.from(end < 0 ? b : b.subarray(0, end)).toString("utf8");
+}
+function parseOctal(b) {
+    // base-256 for sizes above 8 GiB never occurs in npm tarballs
+    const s = cstr(b).trim();
+    return s ? parseInt(s, 8) : 0;
+}
+function parsePax(data) {
+    const out = {};
+    const text = Buffer.from(data).toString("utf8");
+    let i = 0;
+    while (i < text.length) {
+        const space = text.indexOf(" ", i);
+        if (space < 0)
+            break;
+        const len = parseInt(text.slice(i, space), 10);
+        if (!len)
+            break;
+        const record = text.slice(space + 1, i + len - 1);
+        const eq = record.indexOf("=");
+        if (eq > 0)
+            out[record.slice(0, eq)] = record.slice(eq + 1);
+        i += len;
+    }
+    return out;
+}

package/dist/registry/tarball.d.ts

@@ -0,0 +1,16 @@
+import type { Ctx } from "../options.ts";
+import type { PackumentVersion } from "./packument.ts";
+import { type RegistryConfig } from "./npmrc.ts";
+export declare const CHANGELOG_FILE: RegExp;
+export declare function isKeptFile(path: string): boolean;
+export type TarballResult = {
+    ok: true;
+    files: Map<string, Buffer>;
+    integrity: string;
+} | {
+    ok: false;
+    reason: "offline-uncached" | "http-error" | "integrity-mismatch";
+    detail?: string;
+};
+export declare function getTarballFiles(ctx: Ctx, cfg: RegistryConfig, pv: PackumentVersion): Promise<TarballResult>;
+//# sourceMappingURL=tarball.d.ts.map

package/dist/registry/tarball.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarball.d.ts","sourceRoot":"","sources":["../../src/registry/tarball.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AAExC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAe,KAAK,cAAc,EAAE,MAAM,YAAY,CAAA;AAG7D,eAAO,MAAM,cAAc,QACgD,CAAA;AAE3E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMhD;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC3D;IACE,EAAE,EAAE,KAAK,CAAA;IACT,MAAM,EAAE,kBAAkB,GAAG,YAAY,GAAG,oBAAoB,CAAA;IAChE,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAIL,wBAAgB,eAAe,CAC7B,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,gBAAgB,GACnB,OAAO,CAAC,aAAa,CAAC,CAaxB"}

package/dist/registry/tarball.js

@@ -0,0 +1,59 @@
+import { readTarball } from "./tar.js";
+import { OfflineError } from "../infra/http.js";
+import { authHeaders } from "./npmrc.js";
+import { integrityHex, sha1, verifyIntegrity } from "../infra/hash.js";
+export const CHANGELOG_FILE = /^(changelog|changes|history|releases?|news)(\.(md|markdown|txt|rst))?$/i;
+export function isKeptFile(path) {
+    return (path === "package.json" ||
+        /\.d\.[cm]?ts$/.test(path) ||
+        CHANGELOG_FILE.test(path));
+}
+const memory = new Map();
+export function getTarballFiles(ctx, cfg, pv) {
+    const integrity = pv.dist.integrity ??
+        (pv.dist.shasum
+            ? `sha1-${Buffer.from(pv.dist.shasum, "hex").toString("base64")}`
+            : "");
+    const id = integrityHex(integrity) ?? sha1(pv.dist.tarball);
+    let p = memory.get(id);
+    if (!p) {
+        p = load(ctx, cfg, pv, integrity, id);
+        memory.set(id, p);
+    }
+    return p;
+}
+async function load(ctx, cfg, pv, integrity, id) {
+    const key = `tarballs/${id}.tgz`;
+    let bytes = await ctx.cache.getBytes(key);
+    if (!bytes) {
+        if (ctx.offline)
+            return { ok: false, reason: "offline-uncached" };
+        try {
+            const res = await ctx.net(() => ctx.http.get({
+                url: pv.dist.tarball,
+                headers: authHeaders(cfg, pv.dist.tarball),
+            }));
+            if (res.status !== 200)
+                return { ok: false, reason: "http-error", detail: `HTTP ${res.status}` };
+            if (integrity && !verifyIntegrity(res.body, integrity))
+                return { ok: false, reason: "integrity-mismatch" };
+            bytes = res.body;
+            await ctx.cache.setBytes(key, bytes);
+        }
+        catch (error) {
+            if (error instanceof OfflineError)
+                return { ok: false, reason: "offline-uncached" };
+            return { ok: false, reason: "http-error", detail: String(error) };
+        }
+    }
+    try {
+        return { ok: true, files: readTarball(bytes, isKeptFile), integrity };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            reason: "http-error",
+            detail: `unreadable tarball: ${String(error)}`,
+        };
+    }
+}

package/dist/render/groups.d.ts

@@ -0,0 +1,16 @@
+import type { Brief, PackageBrief, Site } from "../model.ts";
+export declare function oneNetOnly(p: PackageBrief): boolean;
+export interface Groups {
+    detailed: PackageBrief[];
+    quiet: PackageBrief[];
+    unseen: PackageBrief[];
+}
+export declare function groupBriefs(brief: Brief): Groups;
+export declare function isUnseenOnly(p: PackageBrief): boolean;
+export declare function sitesFor(p: PackageBrief, names: string[]): Site[];
+export declare function siteLabel(s: Site): string;
+export declare function ago(iso: string, now: number): string;
+export declare function opaqueLabel(p: PackageBrief): string;
+export declare function coverageLabel(p: PackageBrief): string;
+export declare function surfaceLabel(p: PackageBrief): string;
+//# sourceMappingURL=groups.d.ts.map

package/dist/render/groups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../../src/render/groups.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAa5D,wBAAgB,UAAU,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAInD;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,EAAE,YAAY,EAAE,CAAA;IACxB,KAAK,EAAE,YAAY,EAAE,CAAA;IACrB,MAAM,EAAE,YAAY,EAAE,CAAA;CACvB;AAID,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAUhD;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAMrD;AAED,wBAAgB,QAAQ,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,CAOjE;AAED,wBAAgB,SAAS,CAAC,CAAC,EAAE,IAAI,GAAG,MAAM,CAIzC;AAED,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAanD;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAkBrD;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAkBpD"}

package/dist/render/groups.js

@@ -0,0 +1,105 @@
+import { UNSEEN_LABEL } from "../labels.js";
+// reasons that say "the tool cannot see", as opposed to "something changed that you use"
+const UNSEEN = new Set([
+    "opaque-usage",
+    "not-referenced",
+    "blind-spots",
+    "no-evidence",
+    "flagged-install",
+    "surface-incomplete",
+]);
+// a quiet brief that stood on one net: said next to its name, not only in the JSON
+export function oneNetOnly(p) {
+    return p.reasons.some((r) => r.code === "caveat-no-types" || r.code === "caveat-no-notes");
+}
+// Review briefs whose only reason is "cannot see how you use it" are listed on one line each: a full
+// block per linter plugin would bury the packages that actually changed under you.
+export function groupBriefs(brief) {
+    const order = { blocked: 0, review: 1, quiet: 2 };
+    const sorted = [...brief.packages].sort((a, b) => order[a.verdict] - order[b.verdict] || a.pkg.localeCompare(b.pkg));
+    return {
+        detailed: sorted.filter((p) => p.verdict !== "quiet" && !isUnseenOnly(p)),
+        quiet: sorted.filter((p) => p.verdict === "quiet"),
+        unseen: sorted.filter((p) => p.verdict !== "quiet" && isUnseenOnly(p)),
+    };
+}
+export function isUnseenOnly(p) {
+    return (p.verdict === "review" &&
+        p.reasons.every((r) => UNSEEN.has(r.code)) &&
+        p.reasons.some((r) => r.code !== "no-evidence"));
+}
+export function sitesFor(p, names) {
+    const seen = new Map();
+    for (const n of names)
+        for (const s of p.usage.byName[n] ?? [])
+            seen.set(`${s.file}:${s.line}`, s);
+    return [...seen.values()].sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+}
+export function siteLabel(s) {
+    const via = s.via && s.via.length > 0 ? `  (via ${s.via[s.via.length - 1]})` : "";
+    return `${s.file}:${s.line}${s.typeOnly ? "  type" : ""}${via}`;
+}
+export function ago(iso, now) {
+    const ms = now - Date.parse(iso);
+    if (!Number.isFinite(ms))
+        return "unknown";
+    if (ms < 3_600_000)
+        return `${Math.max(1, Math.round(ms / 60_000))}m ago`;
+    if (ms < 172_800_000)
+        return `${Math.round(ms / 3_600_000)}h ago`;
+    return `${Math.round(ms / 86_400_000)}d ago`;
+}
+export function opaqueLabel(p) {
+    const kinds = [
+        ...p.usage.opaque.map((o) => o.kind),
+        ...p.usage.blindSpots.map((b) => b.kind),
+    ];
+    const labels = [...new Set(kinds.map((k) => UNSEEN_LABEL[k] ?? k))];
+    if (p.reasons.some((r) => r.code === "not-referenced"))
+        labels.push("not referenced by any scanned file");
+    for (const code of ["flagged-install", "surface-incomplete"]) {
+        const r = p.reasons.find((x) => x.code === code);
+        if (r)
+            labels.push(r.detail);
+    }
+    return labels.join("; ");
+}
+export function coverageLabel(p) {
+    const n = p.notes;
+    if (n.coverage === "disabled")
+        return "notes disabled";
+    const found = n.perVersion.filter((v) => v.status === "found").length;
+    const total = n.perVersion.length;
+    const sources = [
+        ...new Set(n.perVersion.map((v) => v.source?.kind).filter(Boolean)),
+    ].join(", ");
+    if (n.coverage === "complete")
+        return `notes for ${total}/${total} versions${sources ? ` (${sources})` : ""}`;
+    if (n.coverage === "partial")
+        return `notes for ${found}/${total} versions${sources ? ` (${sources})` : ""}`;
+    if (n.coverage === "none-published")
+        return "this author publishes no notes; behaviour changes are invisible here";
+    const reasons = [
+        ...new Set(n.perVersion.map((v) => v.reason).filter(Boolean)),
+    ].join(", ");
+    return `notes unavailable${reasons ? ` (${reasons})` : ""}`;
+}
+export function surfaceLabel(p) {
+    const s = p.surface;
+    switch (s.status) {
+        case "computed":
+            return `${s.changes ?? 0}`;
+        case "no-types":
+            return `unknown (${s.detail ?? "no types"})`;
+        case "types-from-@types":
+            return "unknown (types live in @types)";
+        case "types-elsewhere":
+            return "unknown (types re-exported from another package)";
+        case "disabled":
+            return s.detail ?? "not computed (--no-surface)";
+        case "offline-uncached":
+            return "unknown (offline, not cached)";
+        case "failed":
+            return `unknown (${s.detail ?? "extraction failed"})`;
+    }
+}

package/dist/render/index.d.ts

@@ -0,0 +1,2 @@
+export { ago, coverageLabel, groupBriefs, type Groups, isUnseenOnly, oneNetOnly, opaqueLabel, siteLabel, sitesFor, surfaceLabel, } from "./groups.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/render/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/render/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,GAAG,EACH,aAAa,EACb,WAAW,EACX,KAAK,MAAM,EACX,YAAY,EACZ,UAAU,EACV,WAAW,EACX,SAAS,EACT,QAAQ,EACR,YAAY,GACb,MAAM,aAAa,CAAA"}

package/dist/render/index.js

@@ -0,0 +1,3 @@
+// Building blocks for a renderer of your own: how briefs are grouped and labelled, shared by the
+// markdown renderer here and the terminal renderer of the CLI.
+export { ago, coverageLabel, groupBriefs, isUnseenOnly, oneNetOnly, opaqueLabel, siteLabel, sitesFor, surfaceLabel, } from "./groups.js";

package/dist/render/json.d.ts

@@ -0,0 +1,119 @@
+import type { Brief, VerdictReason } from "../model.ts";
+export interface SiteV1 {
+    file: string;
+    line: number;
+    column: number;
+    typeOnly: boolean;
+    code: string;
+    via?: string[];
+}
+export interface CannotSeeV1 {
+    kind: string;
+    count: number;
+    examples: SiteV1[];
+}
+export interface PackageV1 {
+    name: string;
+    from: string;
+    to: string;
+    bump: "major" | "minor" | "patch";
+    publishedAt: string;
+    verdict: "quiet" | "review" | "blocked";
+    reasons: VerdictReason[];
+    versionSource: string;
+    manifests: string[];
+    types: {
+        status: string;
+        detail?: string;
+        changes?: number;
+        added?: number;
+        touched: {
+            path: string;
+            alsoAt: string[];
+            change: "removed" | "changed" | "deprecated";
+            certainty: "exact" | "by-name";
+            before?: string[];
+            after?: string[];
+            sites: SiteV1[];
+        }[];
+    };
+    notes: {
+        coverage: string;
+        entries: number;
+        versions: {
+            version: string;
+            status: string;
+            source?: {
+                kind: string;
+                url: string;
+            };
+            reason?: string;
+        }[];
+        matched: {
+            version: string;
+            title: string;
+            breaking: boolean;
+            direct: boolean;
+            refs: string[];
+            names: {
+                name: string;
+                certainty: "exact" | "by-name";
+                where: string;
+            }[];
+        }[];
+        breakingWithoutApi: {
+            version: string;
+            title: string;
+            refs: string[];
+        }[];
+    };
+    usage: {
+        files: number;
+        sites: number;
+        names: {
+            exact: string[];
+            byName: string[];
+        };
+        sitesByName: Record<string, SiteV1[]>;
+        cannotSee: CannotSeeV1[];
+    };
+    heldBack: {
+        version: string;
+        reason: string;
+        publishedAt?: string;
+    }[];
+    alsoAvailable?: {
+        version: string;
+        bump: string;
+    };
+}
+export interface BriefV1 {
+    schemaVersion: 1;
+    tool: {
+        name: "dep-radius";
+        version: string;
+        typescript: string;
+    };
+    root: string;
+    generatedAt: string;
+    exitCode: 0 | 1 | 2;
+    summary: {
+        manifests: number;
+        withUpdate: number;
+        upToDate: number;
+        quiet: number;
+        review: number;
+        blocked: number;
+        notAnalyzed: number;
+    };
+    packages: PackageV1[];
+    notAnalyzed: {
+        name: string;
+        reason: string;
+    }[];
+    wholeProject: CannotSeeV1[];
+    limits: string[];
+}
+export declare function toJsonV1(brief: Brief): BriefV1;
+export declare function renderJson(brief: Brief): string;
+//# sourceMappingURL=json.d.ts.map

package/dist/render/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/render/json.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EAKL,aAAa,EACd,MAAM,aAAa,CAAA;AAMpB,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,OAAO,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAA;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAA;IACvC,OAAO,EAAE,aAAa,EAAE,CAAA;IACxB,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAA;YACZ,MAAM,EAAE,MAAM,EAAE,CAAA;YAChB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAA;YAC5C,SAAS,EAAE,OAAO,GAAG,SAAS,CAAA;YAC9B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;YACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;YAChB,KAAK,EAAE,MAAM,EAAE,CAAA;SAChB,EAAE,CAAA;KACJ,CAAA;IACD,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE;YACR,OAAO,EAAE,MAAM,CAAA;YACf,MAAM,EAAE,MAAM,CAAA;YACd,MAAM,CAAC,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,GAAG,EAAE,MAAM,CAAA;aAAE,CAAA;YACtC,MAAM,CAAC,EAAE,MAAM,CAAA;SAChB,EAAE,CAAA;QACH,OAAO,EAAE;YACP,OAAO,EAAE,MAAM,CAAA;YACf,KAAK,EAAE,MAAM,CAAA;YACb,QAAQ,EAAE,OAAO,CAAA;YACjB,MAAM,EAAE,OAAO,CAAA;YACf,IAAI,EAAE,MAAM,EAAE,CAAA;YACd,KAAK,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;gBAAC,KAAK,EAAE,MAAM,CAAA;aAAE,EAAE,CAAA;SACzE,EAAE,CAAA;QACH,kBAAkB,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,EAAE,CAAA;KACzE,CAAA;IACD,KAAK,EAAE;QACL,KAAK,EAAE,MAAM,CAAA;QACb,KAAK,EAAE,MAAM,CAAA;QACb,KAAK,EAAE;YAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAAC,MAAM,EAAE,MAAM,EAAE,CAAA;SAAE,CAAA;QAC5C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QACrC,SAAS,EAAE,WAAW,EAAE,CAAA;KACzB,CAAA;IACD,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACrE,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAClD;AAED,MAAM,WAAW,OAAO;IACtB,aAAa,EAAE,CAAC,CAAA;IAChB,IAAI,EAAE;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IACjE,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACnB,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;QACb,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,MAAM,CAAA;QACf,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,QAAQ,EAAE,SAAS,EAAE,CAAA;IACrB,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC/C,YAAY,EAAE,WAAW,EAAE,CAAA;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CA8B9C;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAE/C"}

package/dist/render/json.js

@@ -0,0 +1,130 @@
+export function toJsonV1(brief) {
+    const count = (v) => brief.packages.filter((p) => p.verdict === v).length;
+    return {
+        schemaVersion: 1,
+        tool: {
+            name: "dep-radius",
+            version: brief.tool.version,
+            typescript: brief.tool.typescript,
+        },
+        root: brief.root,
+        generatedAt: brief.generatedAt,
+        exitCode: brief.exitCode,
+        summary: {
+            manifests: brief.manifests,
+            withUpdate: brief.packages.length,
+            upToDate: brief.upToDate,
+            quiet: count("quiet"),
+            review: count("review"),
+            blocked: count("blocked"),
+            notAnalyzed: brief.notAnalyzed.length,
+        },
+        packages: brief.packages.map(packageV1),
+        notAnalyzed: brief.notAnalyzed.map((n) => ({
+            name: n.pkg,
+            reason: n.reason,
+        })),
+        wholeProject: brief.global.map(countedV1),
+        limits: brief.limits,
+    };
+}
+export function renderJson(brief) {
+    return `${JSON.stringify(toJsonV1(brief), null, 2)}\n`;
+}
+function packageV1(p) {
+    return {
+        name: p.pkg,
+        from: p.from,
+        to: p.to,
+        bump: p.bump,
+        publishedAt: p.publishedAt,
+        verdict: p.verdict,
+        reasons: p.reasons.map((r) => ({ code: r.code, detail: r.detail })),
+        versionSource: p.versionSource,
+        manifests: p.manifests,
+        types: {
+            status: p.surface.status,
+            ...(p.surface.detail !== undefined ? { detail: p.surface.detail } : {}),
+            ...(p.surface.changes !== undefined
+                ? { changes: p.surface.changes }
+                : {}),
+            ...(p.surface.added !== undefined ? { added: p.surface.added } : {}),
+            touched: p.surface.touched.map((t) => ({
+                path: t.change.path,
+                alsoAt: t.change.alsoAt,
+                change: t.bucket,
+                certainty: t.strength === "strong" ? "exact" : "by-name",
+                ...(t.change.before ? { before: t.change.before } : {}),
+                ...(t.change.after ? { after: t.change.after } : {}),
+                sites: t.sites.map(siteV1),
+            })),
+        },
+        notes: {
+            coverage: p.notes.coverage,
+            entries: p.notes.total,
+            versions: p.notes.perVersion.map((v) => ({
+                version: v.version,
+                status: v.status,
+                ...(v.source
+                    ? { source: { kind: v.source.kind, url: v.source.url } }
+                    : {}),
+                ...(v.reason ? { reason: v.reason } : {}),
+            })),
+            matched: p.notes.matched.map((m) => ({
+                version: m.entry.version,
+                title: m.entry.title,
+                breaking: m.entry.breakingMarker,
+                direct: m.direct,
+                refs: m.entry.refs,
+                names: m.hits.map((h) => ({
+                    name: h.name,
+                    certainty: h.strength === "strong" ? "exact" : "by-name",
+                    where: h.region,
+                })),
+            })),
+            breakingWithoutApi: p.notes.unattributedBreaking.map(entryV1),
+        },
+        usage: {
+            files: p.usage.files,
+            sites: p.usage.sites.length,
+            names: { exact: p.usage.strongNames, byName: p.usage.weakNames },
+            sitesByName: Object.fromEntries(Object.entries(p.usage.byName).map(([name, sites]) => [
+                name,
+                sites.map(siteV1),
+            ])),
+            cannotSee: [
+                ...p.usage.opaque.map(countedV1),
+                ...p.usage.blindSpots.map(countedV1),
+            ],
+        },
+        heldBack: p.skippedNewer.map((s) => ({
+            version: s.version,
+            reason: s.reason,
+            ...(s.publishedAt ? { publishedAt: s.publishedAt } : {}),
+        })),
+        ...(p.alsoAvailable
+            ? {
+                alsoAvailable: {
+                    version: p.alsoAvailable.version,
+                    bump: p.alsoAvailable.bump,
+                },
+            }
+            : {}),
+    };
+}
+function siteV1(s) {
+    return {
+        file: s.file,
+        line: s.line,
+        column: s.col,
+        typeOnly: s.typeOnly,
+        code: s.text,
+        ...(s.via && s.via.length > 0 ? { via: s.via } : {}),
+    };
+}
+function countedV1(c) {
+    return { kind: c.kind, count: c.count, examples: c.examples.map(siteV1) };
+}
+function entryV1(e) {
+    return { version: e.version, title: e.title, refs: e.refs };
+}

package/dist/render/limits.d.ts

@@ -0,0 +1,3 @@
+import type { Brief, PackageBrief } from "../model.ts";
+export declare function limitsFor(packages: PackageBrief[], global: Brief["global"]): string[];
+//# sourceMappingURL=limits.d.ts.map

package/dist/render/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/render/limits.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAGtD,wBAAgB,SAAS,CACvB,QAAQ,EAAE,YAAY,EAAE,EACxB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,GACtB,MAAM,EAAE,CAoDV"}

package/dist/render/limits.js

@@ -0,0 +1,25 @@
+// Only the limits that bore on this run, so the footer stays read.
+export function limitsFor(packages, global) {
+    const out = [];
+    if (packages.length === 0)
+        return out;
+    out.push("Behaviour changes are seen only through release notes; the types and the notes are counted separately, never merged.");
+    if (packages.some((p) => p.usage.weakNames.length > 0))
+        out.push("No type checker runs over your code: members reached through values from other files or callbacks are matched by name only.");
+    if (packages.some((p) => p.surface.status === "no-types" ||
+        p.surface.status === "types-from-@types"))
+        out.push("Packages without their own types are judged from release notes alone; @types packages are analysed as their own dependency.");
+    if (packages.some((p) => p.notes.coverage !== "complete" && p.notes.coverage !== "disabled"))
+        out.push("Release notes are read from the package's changelog and GitHub only; other hosts count as unavailable.");
+    const g = new Map(global.map((x) => [x.kind, x.count]));
+    const dyn = (g.get("dynamic-import-nonliteral") ?? 0) +
+        (g.get("require-nonliteral") ?? 0);
+    if (dyn > 0)
+        out.push(`${dyn} import() or require() calls with a computed name could not be attributed to any package.`);
+    if (g.get("unparseable-file"))
+        out.push(`${g.get("unparseable-file")} files did not parse cleanly; names in them may be missing.`);
+    if (packages.some((p) => p.usage.opaque.some((o) => o.kind === "convention-framework")))
+        out.push("Frameworks used through file conventions are never judged quiet: their imports show little of what depends on them.");
+    out.push("Local names that shadow an import are not analysed, and transitive dependencies are out of scope.");
+    return out;
+}

package/dist/render/markdown.d.ts

@@ -0,0 +1,3 @@
+import type { Brief } from "../model.ts";
+export declare function renderMarkdown(brief: Brief, now: number): string;
+//# sourceMappingURL=markdown.d.ts.map

package/dist/render/markdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/render/markdown.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,aAAa,CAAA;AAatD,wBAAgB,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAmChE"}

package/dist/render/markdown.js

@@ -0,0 +1,62 @@
+import { ago, coverageLabel, groupBriefs, oneNetOnly, opaqueLabel, siteLabel, sitesFor, surfaceLabel, } from "./groups.js";
+// A pull request comment: one table, then a section per package that needs a look.
+export function renderMarkdown(brief, now) {
+    const g = groupBriefs(brief);
+    const out = [];
+    const icon = { blocked: "🛑 blocked", review: "👀 review", quiet: "✅ quiet" };
+    out.push("### radius");
+    out.push("");
+    if (brief.packages.length === 0) {
+        out.push("No dependency has an eligible update.");
+        return `${out.join("\n")}\n`;
+    }
+    out.push("| package | update | verdict | surface changes | changes you touch | notes mentioning you |");
+    out.push("| --- | --- | --- | --- | --- | --- |");
+    for (const p of [...g.detailed, ...g.unseen, ...g.quiet]) {
+        const direct = p.notes.matched.filter((m) => m.direct).length;
+        const possibly = p.notes.matched.length - direct;
+        out.push(`| \`${p.pkg}\` | ${p.from} → ${p.to} (${p.bump}) | ${icon[p.verdict]}${oneNetOnly(p) ? " (one net)" : ""} | ${surfaceLabel(p)} | ${p.surface.status === "computed" ? p.surface.touched.length : "n/a"} | ${p.notes.coverage === "disabled" ? "not read" : `${direct}${possibly ? ` (+${possibly} possibly)` : ""}`} |`);
+    }
+    out.push("");
+    for (const p of g.detailed)
+        out.push(...section(p, now), "");
+    if (g.unseen.length > 0) {
+        out.push("<details><summary>Cannot see how you use these</summary>", "");
+        for (const p of g.unseen)
+            out.push(`- \`${p.pkg}\` ${p.from} → ${p.to}: ${opaqueLabel(p)}`);
+        out.push("", "</details>", "");
+    }
+    if (brief.limits.length > 0) {
+        out.push("<details><summary>Limits</summary>", "");
+        for (const l of brief.limits)
+            out.push(`- ${l}`);
+        out.push("", "</details>");
+    }
+    return `${out.join("\n")}\n`;
+}
+function section(p, now) {
+    const lines = [];
+    lines.push(`#### \`${p.pkg}\` ${p.from} → ${p.to}`);
+    lines.push("");
+    lines.push(`Published ${ago(p.publishedAt, now)} · ${coverageLabel(p)} · used in ${p.usage.files} files`);
+    lines.push("");
+    for (const t of p.surface.touched) {
+        lines.push(`- **${t.bucket}** \`${t.change.path}\`${t.strength === "weak" ? " (by member name)" : ""}`);
+        for (const s of t.sites.slice(0, 5))
+            lines.push(`  - \`${siteLabel(s)}\``);
+    }
+    for (const m of p.notes.matched) {
+        const names = [...new Set(m.hits.map((h) => h.name))];
+        lines.push(`- ${m.entry.version}: ${m.entry.title}${m.direct ? "" : " _(possibly)_"}. You use ${names.map((n) => `\`${n}\``).join(", ")}`);
+        const strong = m.hits
+            .filter((h) => h.strength === "strong")
+            .map((h) => h.name);
+        for (const s of sitesFor(p, strong.length > 0 ? strong : names).slice(0, m.direct ? 3 : 1))
+            lines.push(`  - \`${siteLabel(s)}\``);
+    }
+    for (const e of p.notes.unattributedBreaking)
+        lines.push(`- ${e.version}: ${e.title} _(breaking, names no API)_`);
+    lines.push("");
+    lines.push(`<sub>${p.reasons.map((r) => r.detail).join(" · ")}</sub>`);
+    return lines;
+}