@exodus/stasis 1.0.0-beta.1 → 1.0.0-beta.10

package/src/vfs-bundle.js

@@ -0,0 +1,80 @@
+import { posix } from 'node:path'
+
+import { Vfs } from '@preventive/vfs'
+import { KINDS, checkAhead } from './vfs-bundle/entries.js'
+import { suggestedRepoEntries } from './vfs-bundle/github.js'
+import { NODE_MODULES_MANAGERS, checkCache, checkTarget, checkVfs, detectPackageManager, loadTree, packageManagerFor, vfsHost } from './vfs-bundle/tree.js'
+
+// @exodus/stasis/vfs-bundle: static bundles from a project's lockfile alone, through the
+// dependencies its package manager would install (`packageManager`: 'pnpm', pnpm 9, 10, 11 or 12;
+// 'yarn1', yarn 1.22; 'npm', npm 10.9 or 11; or 'soldeer', Soldeer 0.12; without one, the one whose
+// lockfile installs the project, where only one's does), over the project held in a Vfs, which is
+// only read. The tree is laid out by @preventive/deptree into a Vfs of its own, and nothing is read
+// from disk or written there but the tarballs and zips: fetched from registry.npmjs.org and
+// Soldeer's registry, or read from npm's cache or ~/.audit's where one holds them, every copy held
+// to the lockfile's integrity before it is used; cached only where setCacheDir says. A Soldeer git
+// dependency is GitHub's tarball of its commit, fetched through the `client` buildVfsBundle is given.
+// buildGitHubBundle builds one from a GitHub repo at a commit, or the one a tag names (the default
+// branch's head without either), its tree fetched from GitHub and held to its git tree id, cached
+// there the same way, and its Soldeer git dependencies through the same client.
+
+export { buildVfsBundle } from './cmd/bundle.js'
+export { buildGitHubBundle } from './vfs-bundle/github.js'
+export { setCacheDir } from '@preventive/deptree/pnpm.js'
+export { Vfs }
+
+// A `host` (@exodus/stasis-core/host) over `vfs` alone, its `/` the filesystem's, reading it as it is
+// at each call.
+export function createVfsHost(vfs) {
+  checkVfs('createVfsHost', vfs)
+  return vfsHost(vfs, { cache: false })
+}
+
+// -> { root, vfs, projects, host, stats, installed, packageManager, packageManagerVersion }, as
+// 'pnpm', 'yarn1' or 'npm' installs node_modules: the directory in the project's Vfs it installs cwd
+// from, which holds the lockfile; the Vfs the tree is laid out into, rooted there; the projects'
+// directories from there; the host reading the project through the tree; deptree's counts, and the
+// packages it installs (each by its `path` from there, with the `commit` its version document
+// names, where it names a full one); and the
+// package manager reproduced, at `packageManagerVersion` if given, else the one the root
+// package.json's packageManager pins, else pnpm 10.33.4, yarn 1.22.22 or npm 11.21.0 (which nothing
+// pins: npm reads no packageManager). The host caches what it reads, of the project's Vfs too, so
+// neither is to change while it is used.
+// `os`, `cpu` and `libc` ('glibc', 'musl' or 'unknown', pnpm's and npm's, which takes 'unknown' for
+// none) are the machine packages are matched against: this one's but for what is given (for another
+// os, libc defaults to 'unknown'). Without a `packageManager`, it is the one of the three whose
+// lockfile installs cwd, where only one's does. `cache` is where the packages' tarballs and version
+// documents are kept, as @preventive/upstream's CacheOptions take it: left out, in setCacheDir's
+// cache; a store with `read` and `write`, in place of it; or false, nowhere.
+export async function loadNodeModules({ vfs, packageManager, cwd = '/', packageManagerVersion, os, cpu, libc, cache } = {}) {
+  checkVfs('loadNodeModules', vfs)
+  checkTarget('loadNodeModules', { os, cpu, libc })
+  checkCache('loadNodeModules', cache)
+  const project = vfsHost(vfs)
+  // A real path, as detection and the layout take it.
+  cwd = project.realpath(posix.resolve('/', cwd))
+  packageManager = packageManagerFor('loadNodeModules', project, cwd, { packageManager, packageManagerVersion, os }, NODE_MODULES_MANAGERS)
+  return loadTree({ project, packageManager, cwd, packageManagerVersion, os, cpu, libc, cache })
+}
+
+// -> the entries buildGitHubBundle takes where none are given, as paths from the project's
+// directory, of the kind its package manager builds: `packageManager` if given, else the one
+// detected as the build detects it. For pnpm and yarn 1, the entry points its package.json names,
+// resolved as the build resolves them with the same `conditions`, `mainFields`, `metro`,
+// `platforms` and `typescript` (packageEntries); for Soldeer, its .sol entry points by name
+// and layout (solidityEntries). The options are checked as the build checks them, and `os`, the
+// one the build is for, detects the package manager as there. Of the project held in `vfs`, from
+// `cwd`; or of a GitHub repo, `{ github, sha, tag, directory, client }` as buildGitHubBundle takes
+// them, downloaded as it downloads them.
+export async function suggestedEntries({ vfs, cwd = '/', packageManager, conditions, mainFields, metro, platforms, jsx, typescript, os, ...repo } = {}) {
+  checkTarget('suggestedEntries', { os })
+  const resolution = { conditions, mainFields, metro, platforms, jsx, typescript }
+  if (vfs === undefined && repo.github === undefined) throw new Error('suggestedEntries: a vfs or a github repo is required')
+  if (vfs !== undefined && repo.github !== undefined) throw new Error('suggestedEntries: takes a vfs or a github repo, not both')
+  if (vfs === undefined) return suggestedRepoEntries({ ...repo, packageManager }, { ...resolution, os })
+  checkVfs('suggestedEntries', vfs)
+  const host = vfsHost(vfs)
+  const at = posix.resolve('/', cwd)
+  const pm = checkAhead('suggestedEntries', packageManager ?? detectPackageManager('suggestedEntries', host, at, { os }), resolution)
+  return KINDS[pm.kind].entries(host, at, resolution)
+}

package/src/why.js

@@ -0,0 +1,434 @@
+import { hasNodeModulesSegment, moduleFileKey } from '@exodus/stasis-core/util'
+import { isEvidenceFile } from './audit-corrections.js'
+import { parseFile } from './parse.js'
+
+// `stasis audit --why` support: from an artifact's resolution graph (`imports`)
+// and its per-consumer provenance (`reason`), explain WHY a vulnerable module is
+// present by listing the cross-module import chains that reach it.
+//
+// Corrections apply at the EDGE level (see audit-corrections.js): an edge whose
+// target file is not evidence of the module's real code -- a package.json
+// manifest read, or a corrected file like ws's noop browser.js stub -- never
+// enters the graph, so no displayed chain ends with (or passes through) one, and
+// a consumer that recorded only such files of a package is not one of its reasons.
+//
+// A "path" is a chain of node_modules packages ending at the target module, e.g.
+// `a -> b -> c`. The first-party (`src`) node is never shown: a chain is walked
+// back through cross-module edges and stops at a HEAD -- a module that a src file
+// imports directly, OR one nothing else in node_modules imports (the top of its
+// dependency subtree). So `a -> b -> c` surfaces even when no src file imports
+// `a` directly (a is the top of the chain), and `b -> c` surfaces additionally
+// when `b` is itself imported by src.
+//
+// The reasons shown for a flagged package are EXACTLY the ones that recorded the
+// package itself -- the same set the non-`--why` column reports (see collectReasons).
+// `--why` only adds, per reason, HOW that reason reaches it. So a consumer that
+// imports a package but never recorded it (externalized it) is not one of its
+// reasons and is never shown; and every reason that did record it appears, at least
+// as a bare line.
+//
+// The per-reason PATH is file-level. A consumer "has" the edge `b -> c` only if it
+// recorded the specific file in `b` that imports `c`, so a chain belongs to a
+// consumer only when it recorded the file forming EVERY edge -- `metro: a -> b -> c`
+// can't appear if the file importing `c` from `b` isn't metro's. Each reason's
+// chains are enumerated on its own subgraph (only its edges), so it shows its
+// MAXIMAL file-level path: if metro's edges only reach up to `b`, its line is the
+// shorter `metro: b -> c`; a reason that recorded the package but never imports it
+// through the graph shows a bare `metro: c`. A bundle with a single consumer omits
+// the `reason` map entirely; there every chain renders bare, with no prefix.
+
+// Cap on paths enumerated per target to bound pathological graphs (many diamond
+// dependencies compound into a combinatorial number of simple paths). Hitting it
+// is surfaced as a marker line rather than silently dropped.
+const PATH_CAP = 2000
+
+// Packages a chain never walks PAST: everything imports these build/runtime hubs,
+// so continuing up from them just adds noise. When a chain reaches one it stops
+// there, and the hub becomes the chain's head (`@babel/core -> a -> b -> c`),
+// still prefixed with its own reason.
+const TERMINAL_PACKAGES = new Set(['@babel/core', 'react-native', 'metro'])
+
+// Index one parsed artifact: map every project-relative file to its owning module
+// dir, record each dir's package identity + whether it's a node_modules dep, and
+// keep each dir's EVIDENCE file list (for the target's-own-reason lookup).
+// `fileToDir` is complete; `dirFiles` only holds files that count as real code of
+// the dir (see audit-corrections.js) -- a consumer that recorded nothing of a
+// package but a corrected file / its package.json manifest is not one of its
+// reasons, exactly as in collectReasons.
+function moduleIndex(artifact) {
+  const fileToDir = new Map()
+  const dirInfo = new Map()
+  const dirFiles = new Map()
+  for (const [dir, { name, version, files }] of artifact.modules) {
+    dirInfo.set(dir, { name: name ?? null, version: version ?? null, dep: hasNodeModulesSegment(dir) })
+    const list = []
+    for (const rel of Object.keys(files)) {
+      const f = moduleFileKey(dir, rel)
+      fileToDir.set(f, dir)
+      if (isEvidenceFile(name ?? null, version ?? null, rel)) list.push(f)
+    }
+    dirFiles.set(dir, list)
+  }
+  return { fileToDir, dirInfo, dirFiles }
+}
+
+// Flatten the imports graph (conditions -> parent -> specifier -> target) into
+// deduped file-level edges [parentFile, targetFile]. A `--metro` target may be a
+// { platform: file } map; each platform's file becomes its own edge.
+function fileEdges(imports) {
+  const edges = []
+  const seen = new Set()
+  for (const [, byParent] of imports) {
+    for (const [parent, specifiers] of byParent) {
+      for (const [, target] of specifiers) {
+        const targets = target instanceof Map ? [...target.values()] : [target]
+        for (const t of targets) {
+          const key = `${parent}\0${t}`
+          if (seen.has(key)) continue
+          seen.add(key)
+          edges.push([parent, t])
+        }
+      }
+    }
+  }
+  return edges
+}
+
+// Per-reason cross-module subgraphs. Every import edge is a FILE edge (a specific
+// file in the parent importing the target), and a consumer only "has" that edge if
+// it recorded the PARENT file. So a chain belongs to a reason only when that reason
+// bundled the file forming EVERY one of its edges. We build one subgraph per
+// consumer (bucket) -- holding only the edges that consumer's files created -- and
+// later enumerate that consumer's chains on it. With no reason map there is a single
+// bucket '' holding the full graph (chains render bare). Each subgraph:
+//   adjRev:       depDir -> Set(dep predecessor dir)  -- dep->dep edges, reversed
+//   srcImporters: depDir -> Set(src file)             -- src->dep edges
+// Intra-module edges and edges into a src module are dropped.
+function bucketGraphs(edges, fileToDir, dirInfo, fileReasons) {
+  const graphs = new Map()
+  const graphFor = (bucket) => {
+    let g = graphs.get(bucket)
+    if (g === undefined) graphs.set(bucket, (g = { adjRev: new Map(), srcImporters: new Map() }))
+    return g
+  }
+  for (const [pf, tf] of edges) {
+    const pd = fileToDir.get(pf)
+    const td = fileToDir.get(tf)
+    if (pd === undefined || td === undefined || pd === td) continue
+    const tdi = dirInfo.get(td)
+    if (!tdi.dep) continue
+    // An edge counts only when it targets the module's real code (see
+    // audit-corrections.js): a `package.json` manifest read (react-native scans
+    // sibling packages' manifests for Haste/asset resolution) or a corrected file
+    // (ws's noop browser.js stub) is not a dependency on the module and must not
+    // pull it into the --why graph -- no chain may end (or pass) through one.
+    if (!isEvidenceFile(tdi.name, tdi.version, tf.slice(td.length + 1))) continue
+    // The consumers this edge belongs to: those that recorded its parent file.
+    const buckets = fileReasons === null ? [''] : (fileReasons.get(pf) ?? [])
+    const dep = dirInfo.get(pd).dep
+    for (const bucket of buckets) {
+      const map = dep ? graphFor(bucket).adjRev : graphFor(bucket).srcImporters
+      let set = map.get(td)
+      if (set === undefined) map.set(td, (set = new Set()))
+      set.add(dep ? pd : pf)
+    }
+  }
+  return graphs
+}
+
+// Invert the reason map to file -> Set(consumer). null when the artifact carries
+// no reason map (single-consumer bundle / lockfile) -> chains render bare.
+export function invertReason(reason) {
+  if (!reason) return null
+  const byFile = new Map()
+  for (const [consumer, list] of Object.entries(reason)) {
+    if (!Array.isArray(list)) continue
+    for (const f of list) {
+      let set = byFile.get(f)
+      if (set === undefined) byFile.set(f, (set = new Set()))
+      set.add(consumer)
+    }
+  }
+  return byFile
+}
+
+// dir -> Set(consumer): the consumers that recorded any of the dir's own EVIDENCE
+// files (dirFiles is pre-filtered -- a consumer that recorded only a corrected
+// file / manifest of the dir doesn't count; see moduleIndex). null when the
+// artifact has no reason map. Used to decide whether a bare target belongs to a
+// reason that never imports it (a flagged package a bundler shipped).
+function dirReasonsIndex(dirFiles, fileReasons) {
+  if (fileReasons === null) return null
+  const byDir = new Map()
+  for (const [dir, files] of dirFiles) {
+    let set
+    for (const f of files) for (const c of fileReasons.get(f) ?? []) (set ??= new Set()).add(c)
+    if (set !== undefined) byDir.set(dir, set)
+  }
+  return byDir
+}
+
+// Every simple dep-only path (within one reason's subgraph) that ends at
+// `targetDir`, walking predecessors backward and emitting a path each time its
+// head is a HEAD node (`isHead`) or a terminal package (`isTerminal`). A terminal
+// node ALSO stops the walk -- the chain never goes past @babel/core / react-native
+// / metro, and this applies to `targetDir` too: a terminal target is emitted bare
+// (just `[targetDir]`), never climbed above. Its provenance instead comes from the
+// reason whose subgraph this is. Returns dirs head-first; `truncated` flags the cap.
+function pathsTo(adjRev, isHead, isTerminal, targetDir) {
+  const results = []
+  let truncated = false
+  const walk = (node, suffix, inPath) => {
+    if (results.length >= PATH_CAP) {
+      truncated = true
+      return
+    }
+    const terminal = isTerminal(node)
+    if (isHead(node) || terminal) results.push(suffix)
+    if (terminal) return // don't walk past @babel/core / react-native / metro
+    for (const pred of adjRev.get(node) ?? []) {
+      if (inPath.has(pred)) continue // no repeated module -> break cycles
+      inPath.add(pred)
+      walk(pred, [pred, ...suffix], inPath)
+      inPath.delete(pred)
+    }
+  }
+  walk(targetDir, [targetDir], new Set([targetDir]))
+  return { results, truncated }
+}
+
+// A chain (node names, head first) from index `i` on, as a lookup key; and as a display line.
+const chainKey = (c, i = 0) => c.slice(i).join('\0')
+const renderChain = (c) => c.join(' -> ')
+
+// Display order for one bucket's (deduped) chains:
+//   1. a chain that is a full proper suffix of another always renders before it
+//      (`B -> C` before `A -> B -> C`) -- a hard constraint;
+//   2. chains sharing a head stay contiguous, and recursively chains sharing a
+//      longer prefix stay contiguous within their group -- never interleaved
+//      with other groups;
+//   3. among sibling groups (at every level), the group whose LONGEST chain is
+//      shortest renders first; ties alphabetically.
+// All chains end at the same target, so a full suffix always has a DIFFERENT
+// head: rule 1 only ever orders head groups against each other, never members of
+// one group, and is enforced with a topological pass over the head groups. In
+// the rare cyclic case (mutual suffix constraints through an import cycle) the
+// preferred group order wins and one constraint is dropped.
+function orderChains(chains) {
+  if (chains.length <= 1) return chains
+
+  // Recursive contiguous grouping: `list` shares its first `depth` nodes; group
+  // by the node AT `depth` and order sibling groups shortest-max first.
+  const arrange = (list, depth) => {
+    if (list.length <= 1) return list
+    return [...Map.groupBy(list, (c) => c[depth])]
+      .map(([node, g]) => ({ node, g, max: Math.max(...g.map((c) => c.length)) }))
+      .toSorted((a, b) => a.max - b.max || a.node.localeCompare(b.node))
+      .flatMap(({ g }) => arrange(g, depth + 1))
+  }
+
+  const byHead = Map.groupBy(chains, (c) => c[0])
+
+  // Rule 1: whenever a chain is a full suffix of another, its head group must
+  // render before the extension's head group.
+  const keys = new Set(chains.map((c) => chainKey(c)))
+  const succ = new Map([...byHead.keys()].map((h) => [h, new Set()]))
+  const indeg = new Map([...byHead.keys()].map((h) => [h, 0]))
+  for (const c of chains) {
+    for (let i = 1; i < c.length; i++) {
+      if (!keys.has(chainKey(c, i))) continue
+      const suffixHead = c[i]
+      if (suffixHead === c[0] || succ.get(suffixHead).has(c[0])) continue
+      succ.get(suffixHead).add(c[0])
+      indeg.set(c[0], indeg.get(c[0]) + 1)
+    }
+  }
+
+  const maxLen = new Map([...byHead].map(([h, g]) => [h, Math.max(...g.map((c) => c.length))]))
+  const prefer = (a, b) => maxLen.get(a) - maxLen.get(b) || a.localeCompare(b)
+  const remaining = new Set(byHead.keys())
+  const out = []
+  while (remaining.size > 0) {
+    const free = [...remaining].filter((h) => indeg.get(h) === 0)
+    // No free head means a constraint cycle -- break it by preference.
+    const head = (free.length > 0 ? free : [...remaining]).toSorted(prefer)[0]
+    remaining.delete(head)
+    for (const s of succ.get(head)) indeg.set(s, indeg.get(s) - 1)
+    out.push(...arrange(byHead.get(head), 1))
+  }
+  return out
+}
+
+// Compress one reason bucket's chains (node-name arrays, all ending at the same
+// target). Chains are emitted in display order (orderChains -- prefix groups
+// kept contiguous, a full-suffix chain always before its extensions); each collapses
+// at the earliest node whose remaining sub-path to the target is already
+// recoverable from the lines above it, rendering `prefix -> node -> ... -> target`.
+// A sub-path is recoverable once ANY emitted line shows its head node in the
+// line's visible part -- a full line shows every node, a collapsed line its prefix
+// down to the collapse point -- because from there the earlier lines spell out the
+// rest. So a repeated tail is written out once and referenced with `...`
+// everywhere else, transitively:
+//   D -> C -> B -> A          (full)
+//   P -> E -> D -> ... -> A   (D's tail is in the full line)
+//   Q -> E -> ... -> A        (E's tail is now visible in P's line)
+//   G -> F -> E -> ... -> A
+//   H -> F -> ... -> A        (F's tail is visible in G's line)
+// A collapse hides only nodes between the visible ones and the target, and lines
+// that collapse to identical text are emitted once (a hub reached by several shown
+// sub-paths yields a single `importer -> hub -> ... -> target` per importer).
+function compressChains(chains) {
+  const uniq = [...new Map(chains.map((c) => [renderChain(c), c])).values()]
+  if (uniq.length <= 1) return uniq.map(renderChain)
+  const sorted = orderChains(uniq)
+  const target = sorted[0][sorted[0].length - 1]
+
+  const revealed = new Set() // sub-paths recoverable from lines already emitted
+  const out = []
+  const seen = new Set()
+  const push = (line) => {
+    if (!seen.has(line)) {
+      seen.add(line)
+      out.push(line)
+    }
+  }
+  for (const c of sorted) {
+    // Collapse at the longest proper tail (earliest position, >= 3 nodes so >= 1 is
+    // hidden) that an earlier line already made recoverable.
+    let at = -1
+    for (let i = 1; c.length - i >= 3; i++) {
+      if (revealed.has(chainKey(c, i))) {
+        at = i
+        break
+      }
+    }
+    // Index of the last node this line shows: all of them when full, the collapse
+    // point otherwise.
+    const visible = at === -1 ? c.length - 1 : at
+    if (at === -1) push(renderChain(c))
+    else push(`${renderChain(c.slice(0, at + 1))} -> ... -> ${target}`)
+    // Every sub-path headed by a node this line shows is now recoverable.
+    for (let i = 0; i <= visible; i++) revealed.add(chainKey(c, i))
+  }
+  return out
+}
+
+// Default (non `--why-deep`) pruning: drop a chain when another chain in the SAME
+// bucket is a full proper suffix of it. Those longer chains only tell how the
+// suffix's head is reached through further subdeps -- when that head is itself a
+// direct dependency of src (or the flagged target itself), its own line already
+// explains the pull-in, so `A -> B -> C -> D` is noise next to `B -> C -> D` (and
+// everything is noise next to a bare `D`). Only a FULL suffix counts: chains that
+// merely share a tail (`E -> C -> B -> A` vs `D -> C -> B -> A`) both survive and
+// are left to compressChains. The shortest chain always survives.
+function dropSuffixed(chains) {
+  const keys = new Set(chains.map((c) => chainKey(c)))
+  return chains.filter((c) => {
+    for (let i = 1; i < c.length; i++) {
+      if (keys.has(chainKey(c, i))) return false
+    }
+    return true
+  })
+}
+
+// Map each targeted package (`name@version`) to its ordered `--why` lines.
+// `targetKeys` (optional) restricts work to the packages that matter (the ones
+// carrying advisories); omit it to compute for every node_modules package.
+// `reasonFilter` (optional, from --reason) keeps only chains attributed to that
+// consumer, dropping every other chain (and bare, unattributed chains).
+// By default a chain is dropped when a same-bucket chain is a full suffix of it
+// (see dropSuffixed); `deep` (--why-deep) keeps every chain. Chains are then
+// deduplicated and compressed per reason bucket (see compressChains), unless
+// `full` (--why-full) -- then every surviving chain is spelled out with no `...`
+// collapse, in the same shortest-first order. The flags compose: deep + full is
+// the complete raw listing. Artifacts without a resolution graph (`imports`)
+// contribute nothing.
+export function collectWhy(files, targetKeys, reasonFilter = null, { deep = false, full = false } = {}) {
+  // key -> reason bucket ('' = unattributed) -> Map(chainKey -> node-name array)
+  const acc = new Map()
+  const truncatedKeys = new Set()
+  const bucketChains = (key, bucket) => {
+    let buckets = acc.get(key)
+    if (buckets === undefined) acc.set(key, (buckets = new Map()))
+    let chains = buckets.get(bucket)
+    if (chains === undefined) buckets.set(bucket, (chains = new Map()))
+    return chains
+  }
+  const addChain = (key, bucket, nodes) => bucketChains(key, bucket).set(chainKey(nodes), nodes)
+
+  const EMPTY_GRAPH = { adjRev: new Map(), srcImporters: new Map() }
+
+  for (const file of files) {
+    const artifact = parseFile(file)
+    const imports = artifact.imports
+    if (!imports || imports.size === 0) continue
+
+    const { fileToDir, dirInfo, dirFiles } = moduleIndex(artifact)
+    const edges = fileEdges(imports)
+    const fileReasons = invertReason(artifact.reason)
+    const graphs = bucketGraphs(edges, fileToDir, dirInfo, fileReasons)
+    const dirReasons = dirReasonsIndex(dirFiles, fileReasons)
+    // Terminal packages end a chain regardless of what imports them.
+    const isTerminal = (node) => TERMINAL_PACKAGES.has(dirInfo.get(node)?.name)
+
+    // Group target dirs by `name@version` (a package can appear at several dirs,
+    // e.g. nested node_modules); paths from every matching dir are unioned.
+    const dirsByKey = new Map()
+    for (const [dir, info] of dirInfo) {
+      if (!info.dep || !info.name || !info.version) continue
+      const key = `${info.name}@${info.version}`
+      if (targetKeys && !targetKeys.has(key)) continue
+      let arr = dirsByKey.get(key)
+      if (arr === undefined) dirsByKey.set(key, (arr = []))
+      arr.push(dir)
+    }
+    if (dirsByKey.size === 0) continue
+
+    for (const [key, dirs] of dirsByKey) {
+      for (const targetDir of dirs) {
+        // The reasons to report are exactly the ones the FLAGGED package itself was
+        // recorded under -- identical to the non-`--why` column (see collectReasons).
+        // For each, enumerate that reason's MAXIMAL file-level chains on its own
+        // subgraph; a reason that recorded the package but doesn't import it through
+        // the graph still yields a bare line. A reason that IMPORTS the package but
+        // never recorded it (externalized it) is not one of the package's reasons and
+        // is not shown -- so the --why reason set matches non-`--why` exactly.
+        const own = fileReasons === null ? [''] : (dirReasons.get(targetDir) ?? [])
+        for (const bucket of own) {
+          if (reasonFilter !== null && bucket !== reasonFilter) continue
+          const { adjRev, srcImporters } = graphs.get(bucket) ?? EMPTY_GRAPH
+          // A head tops a chain: a src file imports it directly, or nothing else
+          // in this bucket's graph imports it.
+          const isHead = (node) => srcImporters.has(node) || !adjRev.has(node)
+          const { results, truncated } = pathsTo(adjRev, isHead, isTerminal, targetDir)
+          if (truncated) truncatedKeys.add(key)
+          for (const p of results) {
+            const nodes = p.map((d) => dirInfo.get(d)?.name ?? d)
+            addChain(key, reasonFilter !== null ? '' : bucket, nodes)
+          }
+        }
+      }
+    }
+  }
+
+  // --why-full: no `...` collapse -- every chain spelled out, in the same display
+  // order as the collapsed rendering (see orderChains).
+  const renderFull = (chains) => orderChains(chains).map(renderChain)
+
+  // Prune (unless deep), compress (unless full), and render each bucket (buckets
+  // sorted so a consumer's chains group together; bare '' sorts first).
+  const byPkg = new Map()
+  for (const [key, buckets] of acc) {
+    const lines = []
+    for (const bucket of [...buckets.keys()].toSorted((a, b) => a.localeCompare(b))) {
+      let chains = [...buckets.get(bucket).values()]
+      if (!deep) chains = dropSuffixed(chains)
+      for (const rendered of (full ? renderFull(chains) : compressChains(chains))) {
+        lines.push(bucket ? `${bucket}: ${rendered}` : rendered)
+      }
+    }
+    if (truncatedKeys.has(key)) lines.push(`… (${PATH_CAP}+ paths, truncated)`)
+    byPkg.set(key, lines)
+  }
+  return byPkg
+}

package/src/apis/npm/index.js

@@ -1,36 +0,0 @@
-import assert from 'node:assert/strict'
-
-import semver from './semver.cjs'
-
-const packageNameRegex = /^(@[\da-z-]+\/)?[\w-]+(\.[\w-]+)*$/u
-
-export async function advisories(list, { signal = AbortSignal.timeout(30_000) } = {}) {
-  const groups = new Map()
-  for (const { name, version } of list) {
-    assert(typeof name === 'string' && typeof version === 'string')
-    assert(packageNameRegex.test(name), `Unexpected package name: ${name}`)
-    assert(semver.valid(version), `Invalid version: ${version}`)
-    if (!groups.has(name)) groups.set(name, new Set())
-    groups.get(name).add(version)
-  }
-
-  const entries = [...groups].map(([k, v]) => [k, [...v].toSorted((a, b) => semver.compare(a, b))])
-  const body = Object.fromEntries(entries.toSorted((a, b) => a[0] < b[0] ? -1 : 1))
-
-  let res
-  try {
-    res = await fetch('https://registry.npmjs.org/-/npm/v1/security/advisories/bulk', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(body),
-      signal,
-    })
-  } catch (cause) {
-    throw new Error(`npm advisories request failed: ${cause.message}`, { cause })
-  }
-  if (!res.ok) {
-    const text = await res.text().catch(() => '')
-    throw new Error(`npm advisories request failed: ${res.status} ${res.statusText}${text ? ` — ${text.slice(0, 200)}` : ''}`)
-  }
-  return res.json()
-}

package/src/apis/npm/semver.cjs

@@ -1,44 +0,0 @@
-'use strict'
-
-const assert = require('node:assert/strict')
-const { basename, dirname, resolve } = require('node:path')
-
-let semver
-
-const argv0 = process.argv[0] // not process.argv0 which lacks path
-
-function getSemver() {
-  if (semver) return semver
-
-  // Coherence check that we got Node.js path there
-  assert(['node', 'node.exe'].includes(basename(argv0)))
-  assert.equal(basename(argv0), basename(process.argv0))
-
-  // Load semver from npm bundled with Node.js
-  const semverDir = resolve(dirname(argv0), '../lib/node_modules/npm/node_modules/semver')
-  semver = require(semverDir)
-  return semver
-}
-
-exports.compare = (...a) => getSemver().compare(...a)
-exports.gtr = (...a) => getSemver().gtr(...a)
-exports.lt = (...a) => getSemver().lt(...a)
-exports.lte = (...a) => getSemver().lte(...a)
-exports.ltr = (...a) => getSemver().ltr(...a)
-exports.satisfies = (...a) => getSemver().satisfies(...a)
-exports.validRange = (...a) => getSemver().validRange(...a)
-
-exports.valid = (version, options) => {
-  // Fast path for certainly valid versions
-  if (
-    options === undefined &&
-    typeof version === 'string' &&
-    version.length <= 256 &&
-    // 1-15 chars because it must fit in Number.MAX_SAFE_INTEGER
-    /^(0|[1-9]\d{0,14})\.(0|[1-9]\d{0,14})\.(0|[1-9]\d{0,14})$/iu.test(version)
-  ) {
-    return version
-  }
-
-  return getSemver().valid(version, options)
-}