@loomhelix/deptrail 0.1.0

package/dist/git/tree-index.js

@@ -0,0 +1,87 @@
+import { posix } from 'node:path';
+export class TreeTooLargeError extends Error {
+    constructor(maxEntries) {
+        super(`the tree has more than ${maxEntries} entries`);
+        this.name = 'TreeTooLargeError';
+    }
+}
+const KIND_BY_MODE = {
+    '040000': 'dir',
+    '100644': 'file',
+    '100755': 'file',
+    '120000': 'symlink',
+};
+const TOP = '.';
+const SUBMODULE_MODE = '160000';
+const PARENT_PREFIX = '..';
+function normalizePrefix(prefix) {
+    return prefix.replace(/\/+$/, '');
+}
+function parentOf(fullPath) {
+    const slash = fullPath.lastIndexOf('/');
+    return slash === -1 ? '' : fullPath.slice(0, slash);
+}
+function nameOf(fullPath) {
+    return fullPath.slice(fullPath.lastIndexOf('/') + 1);
+}
+function keyOf(fullPath, root) {
+    if (fullPath === root)
+        return TOP;
+    if (root === '')
+        return fullPath;
+    if (fullPath.startsWith(`${root}/`))
+        return fullPath.slice(root.length + 1);
+    return posix.relative(root, fullPath);
+}
+export function parseTree(output, prefix, maxEntries) {
+    const root = normalizePrefix(prefix);
+    const listings = new Map([['', []]]);
+    const blobs = new Map();
+    const kinds = new Map();
+    const submodules = [];
+    let count = 0;
+    let start = 0;
+    while (start < output.length) {
+        let end = output.indexOf(0, start);
+        if (end === -1)
+            end = output.length;
+        const record = output.subarray(start, end).toString('utf8');
+        start = end + 1;
+        if (record === '')
+            continue;
+        count += 1;
+        if (count > maxEntries)
+            throw new TreeTooLargeError(maxEntries);
+        const tab = record.indexOf('\t');
+        if (tab === -1)
+            continue;
+        const [mode = '', , id = ''] = record.slice(0, tab).split(' ');
+        const fullPath = record.slice(tab + 1);
+        if (mode === SUBMODULE_MODE) {
+            const key = keyOf(fullPath, root);
+            if (!key.startsWith(PARENT_PREFIX))
+                submodules.push(key);
+            continue;
+        }
+        const kind = KIND_BY_MODE[mode];
+        if (!kind || fullPath === '')
+            continue;
+        const parent = parentOf(fullPath);
+        let siblings = listings.get(parent);
+        if (!siblings) {
+            siblings = [];
+            listings.set(parent, siblings);
+        }
+        siblings.push({ name: nameOf(fullPath), kind });
+        const key = keyOf(fullPath, root);
+        kinds.set(key, kind);
+        if (kind === 'dir' && !listings.has(fullPath))
+            listings.set(fullPath, []);
+        if (kind === 'file')
+            blobs.set(key, id);
+    }
+    const directories = new Map([...listings].map(([fullPath, entries]) => [keyOf(fullPath, root), entries]));
+    if (!directories.has(TOP))
+        directories.set(TOP, []);
+    return { directories, blobs, kinds, submodules };
+}

package/dist/graph/global-index.js

@@ -0,0 +1,19 @@
+import { PLACEHOLDER_PREFIX } from "../model.js";
+export function buildGlobalIndex(roots) {
+    const index = new Map();
+    for (const root of roots) {
+        if (root.status !== 'ready')
+            continue;
+        for (const node of root.packages.values()) {
+            if (node.id.startsWith(PLACEHOLDER_PREFIX))
+                continue;
+            const entry = { rootId: root.id, nodeId: node.id, version: node.version };
+            const entries = index.get(node.name);
+            if (entries)
+                entries.push(entry);
+            else
+                index.set(node.name, [entry]);
+        }
+    }
+    return index;
+}

package/dist/graph/root-graph-builder.js

@@ -0,0 +1,114 @@
+import { IMPORTER_PREFIX, PLACEHOLDER_PREFIX, } from "../model.js";
+export class RootGraphBuilder {
+    init;
+    internTable = new Map();
+    importers = new Map();
+    packages = new Map();
+    warnings = [];
+    constructor(init) {
+        this.init = init;
+    }
+    intern(value) {
+        const stored = this.internTable.get(value);
+        if (stored !== undefined)
+            return stored;
+        this.internTable.set(value, value);
+        return value;
+    }
+    addImporter(path, name) {
+        const id = IMPORTER_PREFIX + path;
+        if (!this.importers.has(id)) {
+            this.importers.set(id, { id, path, name: this.intern(name), deps: [], dependents: [] });
+        }
+        return id;
+    }
+    addPackage(id, name, version, peerSuffix) {
+        if (this.hasNode(id))
+            return;
+        const internedId = this.intern(id);
+        const node = {
+            id: internedId,
+            name: this.intern(name),
+            version: this.intern(version),
+            deps: [],
+            dependents: [],
+        };
+        if (peerSuffix !== undefined)
+            node.peerSuffix = this.intern(peerSuffix);
+        this.packages.set(internedId, node);
+    }
+    markNonRegistry(id) {
+        const node = this.packages.get(id);
+        if (node)
+            node.nonRegistry = true;
+    }
+    hasNode(id) {
+        return this.importers.has(id) || this.packages.has(id);
+    }
+    addEdge(from, edge) {
+        const source = this.findNode(from);
+        if (!source)
+            throw new Error(`Cannot add an edge from unknown node ${from}`);
+        const alreadyPresent = source.deps.some((existing) => existing.to === edge.to && existing.kind === edge.kind);
+        if (alreadyPresent)
+            return;
+        source.deps.push({ to: this.intern(edge.to), kind: edge.kind, range: this.intern(edge.range) });
+    }
+    warn(message) {
+        this.warnings.push(message);
+    }
+    build() {
+        this.resolveMissingTargets();
+        this.rebuildDependents();
+        return {
+            id: this.init.id,
+            path: this.init.path,
+            manager: this.init.manager,
+            source: this.init.source,
+            status: 'ready',
+            importers: [...this.importers.values()],
+            packages: this.packages,
+            warnings: [...this.warnings],
+        };
+    }
+    findNode(id) {
+        return this.importers.get(id) ?? this.packages.get(id);
+    }
+    allNodes() {
+        return [...this.importers.values(), ...this.packages.values()];
+    }
+    resolveMissingTargets() {
+        for (const node of this.allNodes()) {
+            for (const edge of node.deps) {
+                if (this.hasNode(edge.to))
+                    continue;
+                edge.to = this.addPlaceholder(edge.to);
+            }
+        }
+    }
+    addPlaceholder(missingTarget) {
+        const id = this.intern(PLACEHOLDER_PREFIX + missingTarget);
+        if (this.packages.has(id))
+            return id;
+        this.packages.set(id, { id, name: this.intern('?'), version: this.intern(''), deps: [], dependents: [] });
+        this.warn(`Unresolved dependency ${missingTarget}`);
+        return id;
+    }
+    rebuildDependents() {
+        const nodes = this.allNodes();
+        for (const node of nodes)
+            node.dependents = [];
+        for (const parent of nodes) {
+            for (const edge of parent.deps)
+                this.appendDependent(edge.to, parent.id);
+        }
+    }
+    appendDependent(targetId, parentId) {
+        const target = this.findNode(targetId);
+        if (!target)
+            return;
+        const lastParent = target.dependents[target.dependents.length - 1];
+        if (lastParent !== parentId)
+            target.dependents.push(parentId);
+    }
+}

package/dist/graph/serialize.js

@@ -0,0 +1,19 @@
+export function serializeRootGraph(graph) {
+    const { config, packages, ...rest } = graph;
+    const serialized = { ...rest, hasAuth: config?.hasAuth ?? false, packages: [...packages.values()] };
+    return serialized;
+}
+export function deserializeRootGraph(json) {
+    const serialized = json;
+    if (typeof serialized !== 'object' || serialized === null || !Array.isArray(serialized.packages)) {
+        throw new Error('Serialized root graph is malformed');
+    }
+    const { hasAuth: _hasAuth, packages: serializedPackages, ...rest } = serialized;
+    const packages = new Map();
+    for (const node of serializedPackages)
+        packages.set(node.id, node);
+    return { ...rest, packages };
+}
+export function serializeScan(scan) {
+    return { repoPath: scan.repoPath, scannedAt: scan.scannedAt, roots: scan.roots.map(serializeRootGraph) };
+}

package/dist/model.js

@@ -0,0 +1,2 @@
+export const IMPORTER_PREFIX = 'importer:';
+export const PLACEHOLDER_PREFIX = '?:';

package/dist/query/children.js

@@ -0,0 +1,38 @@
+import { passingEdges, requireNode, viewOf } from "./lookup.js";
+function rowsOf(root, id, kinds) {
+    return passingEdges(requireNode(root, id), kinds).map((edge) => {
+        const child = requireNode(root, edge.to);
+        return {
+            node: viewOf(child),
+            kind: edge.kind,
+            range: edge.range,
+            hasChildren: child.deps.some((childEdge) => kinds.has(childEdge.kind)),
+            repeated: false,
+        };
+    });
+}
+export function children(root, id, depth, kinds) {
+    const focus = requireNode(root, id);
+    const levels = Math.max(1, Math.floor(depth));
+    const rows = rowsOf(root, id, kinds);
+    const nested = {};
+    const expanded = new Set([id]);
+    let currentLevel = rows;
+    for (let level = 1; level <= levels && currentLevel.length > 0; level++) {
+        const nextLevel = [];
+        for (const row of currentLevel) {
+            if (expanded.has(row.node.id)) {
+                row.repeated = true;
+                continue;
+            }
+            if (level === levels)
+                continue;
+            expanded.add(row.node.id);
+            const childRows = rowsOf(root, row.node.id, kinds);
+            nested[row.node.id] = childRows;
+            nextLevel.push(...childRows);
+        }
+        currentLevel = nextLevel;
+    }
+    return { node: viewOf(focus), rows, nested };
+}

package/dist/query/compare-shape.js

@@ -0,0 +1,13 @@
+function sourceDiffers(notes) {
+    const sources = notes.flatMap((note) => (note.kind === 'inexact' ? [note.source] : []));
+    return sources.length === 1 || new Set(sources).size > 1;
+}
+export function hasChanges(root) {
+    return (root.presence !== 'both' ||
+        root.state !== 'ready' ||
+        sourceDiffers(root.notes) ||
+        root.versions.length > 0 ||
+        root.directs.length > 0 ||
+        root.importers.length > 0 ||
+        root.risk.length > 0);
+}

package/dist/query/compare.js

@@ -0,0 +1,245 @@
+import semver from 'semver';
+import { IMPORTER_PREFIX, PLACEHOLDER_PREFIX } from "../model.js";
+import { SEVERITY_ORDER } from "../enrich/types.js";
+import { nodeAdvisories, nodeMeta, worstSeverity } from "./enrichment-lookup.js";
+import { compareVersions, packageVersions } from "./graph-diff.js";
+export * from "./compare-shape.js";
+const EXACT_SOURCES = new Set(['lockfile', 'installed']);
+const NO_VERSIONS = new Set();
+const TOP_DIRECTORY = '.';
+function compareText(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function versionKey(name, version) {
+    return `${name}@${version}`;
+}
+function indexVersions(root) {
+    const nodes = new Map();
+    for (const node of root.packages.values()) {
+        if (node.id.startsWith(PLACEHOLDER_PREFIX))
+            continue;
+        const key = versionKey(node.name, node.version);
+        if (!nodes.has(key))
+            nodes.set(key, node);
+    }
+    return nodes;
+}
+function sideStateOf(root) {
+    return { root, versions: packageVersions(root), nodes: indexVersions(root) };
+}
+function sorted(versions) {
+    return [...versions].sort(compareVersions);
+}
+function onlyIn(source, other) {
+    return sorted([...source].filter((version) => !other.has(version)));
+}
+function versionChangeKind(base, target) {
+    if (base.length === 0)
+        return 'added';
+    if (target.length === 0)
+        return 'removed';
+    if (base.length === 1 && target.length === 1 && semver.valid(base[0]) && semver.valid(target[0])) {
+        return semver.gt(target[0], base[0]) ? 'upgraded' : 'downgraded';
+    }
+    return 'changed';
+}
+function versionChanges(base, target) {
+    const names = [...new Set([...base.versions.keys(), ...target.versions.keys()])].sort(compareText);
+    const versions = [];
+    const baseOnly = new Map();
+    const targetOnly = new Map();
+    for (const name of names) {
+        const baseSet = base.versions.get(name) ?? NO_VERSIONS;
+        const targetSet = target.versions.get(name) ?? NO_VERSIONS;
+        const removed = onlyIn(baseSet, targetSet);
+        const added = onlyIn(targetSet, baseSet);
+        if (removed.length === 0 && added.length === 0)
+            continue;
+        if (removed.length > 0)
+            baseOnly.set(name, removed);
+        if (added.length > 0)
+            targetOnly.set(name, added);
+        const baseVersions = sorted(baseSet);
+        const targetVersions = sorted(targetSet);
+        const change = { name, change: versionChangeKind(baseVersions, targetVersions), base: baseVersions, target: targetVersions };
+        const highest = targetVersions.at(-1);
+        const targetNode = highest === undefined ? undefined : target.nodes.get(versionKey(name, highest))?.id;
+        if (targetNode !== undefined)
+            change.targetNode = targetNode;
+        versions.push(change);
+    }
+    return { versions, baseOnly, targetOnly };
+}
+function allVersionsOf(side) {
+    return new Map([...side.versions].map(([name, versions]) => [name, sorted(versions)]));
+}
+function dependencyName(root, edge) {
+    if (edge.to.startsWith(IMPORTER_PREFIX))
+        return root.importers.find((importer) => importer.id === edge.to)?.name ?? edge.to;
+    return root.packages.get(edge.to)?.name ?? edge.to;
+}
+function edgesByKey(root, importer) {
+    const edges = new Map();
+    for (const edge of importer.deps) {
+        const name = dependencyName(root, edge);
+        edges.set(`${name}\0${edge.kind}`, { name, edge });
+    }
+    return edges;
+}
+function directChangesOf(base, target, baseImporter, targetImporter) {
+    const baseEdges = edgesByKey(base, baseImporter);
+    const targetEdges = edgesByKey(target, targetImporter);
+    const changes = [];
+    const identity = { importer: targetImporter.path, importerName: targetImporter.name };
+    for (const [key, before] of baseEdges) {
+        const after = targetEdges.get(key);
+        if (after === undefined) {
+            changes.push({ ...identity, name: before.name, kind: before.edge.kind, change: 'removed', base: before.edge.range });
+        }
+        else if (after.edge.range !== before.edge.range) {
+            changes.push({ ...identity, name: before.name, kind: before.edge.kind, change: 'changed', base: before.edge.range, target: after.edge.range, targetNode: after.edge.to });
+        }
+    }
+    for (const [key, after] of targetEdges) {
+        if (baseEdges.has(key))
+            continue;
+        changes.push({ ...identity, name: after.name, kind: after.edge.kind, change: 'added', target: after.edge.range, targetNode: after.edge.to });
+    }
+    return changes;
+}
+function workspaceChanges(base, target) {
+    const baseByPath = new Map(base.importers.map((importer) => [importer.path, importer]));
+    const targetByPath = new Map(target.importers.map((importer) => [importer.path, importer]));
+    const directs = [];
+    const importers = [];
+    for (const [path, importer] of baseByPath) {
+        const counterpart = targetByPath.get(path);
+        if (counterpart === undefined)
+            importers.push({ path, name: importer.name, change: 'removed' });
+        else
+            directs.push(...directChangesOf(base, target, importer, counterpart));
+    }
+    for (const [path, importer] of targetByPath) {
+        if (!baseByPath.has(path))
+            importers.push({ path, name: importer.name, change: 'added' });
+    }
+    directs.sort((left, right) => compareText(left.importer, right.importer) || compareText(left.name, right.name) || compareText(left.kind, right.kind));
+    importers.sort((left, right) => compareText(left.path, right.path));
+    return { directs, importers };
+}
+function severityRank(risk) {
+    return risk.severity === undefined ? SEVERITY_ORDER.length : SEVERITY_ORDER.indexOf(risk.severity);
+}
+function compareRisk(left, right) {
+    const byChange = left.change === right.change ? 0 : left.change === 'introduced' ? -1 : 1;
+    return byChange || severityRank(left) - severityRank(right) || compareText(left.name, right.name) || compareVersions(left.version, right.version);
+}
+function isPending(view, root, node) {
+    const match = view.matchOf(root, node);
+    if (match.state === 'pending' || view.registryOf(root, node).state === 'pending')
+        return true;
+    return (match.state === 'ok' || match.state === 'stale') && match.vulns.length > 0 && view.advisoriesOf(node.name).state === 'pending';
+}
+function riskOf(view, sides) {
+    const risk = [];
+    const pending = new Set();
+    for (const { side, only, change } of sides) {
+        for (const [name, versions] of only) {
+            for (const version of versions) {
+                const node = side.nodes.get(versionKey(name, version));
+                if (node === undefined)
+                    continue;
+                if (isPending(view, side.root, node))
+                    pending.add(versionKey(name, version));
+                const located = change === 'introduced' ? { targetNode: node.id } : {};
+                const advisories = nodeAdvisories(view, side.root, node);
+                if (advisories.length > 0) {
+                    const severity = worstSeverity(advisories.map((advisory) => advisory.severity));
+                    risk.push({ name, version, issue: 'vulnerability', change, ...(severity === undefined ? {} : { severity }), ...located });
+                }
+                if (nodeMeta(view, side.root, node)?.deprecated[version] !== undefined) {
+                    risk.push({ name, version, issue: 'deprecated', change, ...located });
+                }
+            }
+        }
+    }
+    return { risk: risk.sort(compareRisk), riskPending: pending.size };
+}
+function emptyComparison(rootId, presence, state, notes, exact) {
+    return { rootId, presence, state, notes, exact, versions: [], directs: [], importers: [], risk: [], riskPending: 0 };
+}
+function isExact(root) {
+    return EXACT_SOURCES.has(root.source);
+}
+function sideNotes(sides) {
+    const notes = [];
+    for (const [side, root] of sides) {
+        if (root === undefined)
+            continue;
+        if (root.status === 'failed')
+            notes.push({ side, kind: 'failed', error: root.error ?? '' });
+        else if (!isExact(root))
+            notes.push({ side, kind: 'inexact', source: root.source });
+    }
+    return notes;
+}
+function isInside(rootId, directories) {
+    return (directories ?? []).some((directory) => directory === TOP_DIRECTORY || rootId === directory || rootId.startsWith(`${directory}/`));
+}
+function skippingSide(rootId, sides, baseRoot, targetRoot) {
+    if (baseRoot === undefined && isInside(rootId, sides.base.skippedSubmodules))
+        return 'base';
+    if (targetRoot === undefined && isInside(rootId, sides.target.skippedSubmodules))
+        return 'target';
+    return undefined;
+}
+function compareRoot(view, rootId, base, target, skippedBy) {
+    const presence = base === undefined ? 'target-only' : target === undefined ? 'base-only' : 'both';
+    if (skippedBy !== undefined)
+        return emptyComparison(rootId, presence, 'ready', [{ side: skippedBy, kind: 'submodule' }], false);
+    const present = [base, target].filter((root) => root !== undefined);
+    const exact = present.every(isExact);
+    if (present.some((root) => root.status === 'scanning'))
+        return emptyComparison(rootId, presence, 'scanning', [], exact);
+    const notes = sideNotes([
+        ['base', base],
+        ['target', target],
+    ]);
+    if (present.some((root) => root.status === 'failed'))
+        return emptyComparison(rootId, presence, 'failed', notes, exact);
+    const comparison = emptyComparison(rootId, presence, 'ready', notes, exact);
+    if (base !== undefined && target !== undefined) {
+        const baseState = sideStateOf(base);
+        const targetState = sideStateOf(target);
+        Object.assign(comparison, workspaceChanges(base, target));
+        if (!exact)
+            return comparison;
+        const { versions, baseOnly, targetOnly } = versionChanges(baseState, targetState);
+        comparison.versions = versions;
+        Object.assign(comparison, riskOf(view, [
+            { side: targetState, only: targetOnly, change: 'introduced' },
+            { side: baseState, only: baseOnly, change: 'resolved' },
+        ]));
+        return comparison;
+    }
+    if (!exact)
+        return comparison;
+    const single = sideStateOf((base ?? target));
+    Object.assign(comparison, riskOf(view, [{ side: single, only: allVersionsOf(single), change: target === undefined ? 'resolved' : 'introduced' }]));
+    return comparison;
+}
+export function compareSources(view, base, target) {
+    const baseById = new Map(base.roots.map((root) => [root.id, root]));
+    const targetById = new Map(target.roots.map((root) => [root.id, root]));
+    const rootIds = [...new Set([...baseById.keys(), ...targetById.keys()])].sort(compareText);
+    const complete = [...base.roots, ...target.roots].every((root) => root.status !== 'scanning');
+    return {
+        revision: view.revision,
+        complete,
+        roots: rootIds.map((rootId) => {
+            const baseRoot = baseById.get(rootId);
+            const targetRoot = targetById.get(rootId);
+            return compareRoot(view, rootId, baseRoot, targetRoot, skippingSide(rootId, { base, target }, baseRoot, targetRoot));
+        }),
+    };
+}

package/dist/query/decorations.js

@@ -0,0 +1,121 @@
+import { IMPORTER_PREFIX } from "../model.js";
+import { SEVERITY_ORDER } from "../enrich/types.js";
+import { nodeAdvisories, nodeMeta, worstSeverity } from "./enrichment-lookup.js";
+import { upwardIndex } from "./dependents.js";
+import { ALL_KINDS, findNode } from "./lookup.js";
+import { outdatedLevel } from "./versions.js";
+const memo = new WeakMap();
+const countsMemo = new WeakMap();
+function memoKey(view, kinds) {
+    return `${view.revision}|${[...kinds].sort().join(',')}`;
+}
+function decorateNode(view, root, node) {
+    const decoration = {};
+    const advisories = nodeAdvisories(view, root, node);
+    if (advisories.length > 0) {
+        const vuln = {
+            severity: worstSeverity(advisories.map((advisory) => advisory.severity)),
+            count: advisories.length,
+        };
+        if (advisories.some((advisory) => advisory.malicious))
+            vuln.malicious = true;
+        decoration.vuln = vuln;
+    }
+    const meta = nodeMeta(view, root, node);
+    if (meta) {
+        if (meta.deprecated[node.version] !== undefined)
+            decoration.deprecated = true;
+        const latest = meta.distTags.latest;
+        const level = outdatedLevel(node.version, latest);
+        if (level && latest)
+            decoration.outdated = { level, latest };
+    }
+    return decoration;
+}
+function rollUpVulnerabilities(root, kinds, vulnerable, result) {
+    const { ids, positionOf, parentStarts, parentPositions } = upwardIndex(root, kinds);
+    const belowCounts = new Int32Array(ids.length);
+    const worstRanks = new Int8Array(ids.length);
+    const reachedBy = new Int32Array(ids.length).fill(-1);
+    const queue = new Int32Array(ids.length);
+    vulnerable.forEach(({ node, severity }, source) => {
+        const start = positionOf.get(node.id);
+        if (start === undefined)
+            return;
+        const rank = SEVERITY_ORDER.indexOf(severity);
+        reachedBy[start] = source;
+        queue[0] = start;
+        let queued = 1;
+        for (let cursor = 0; cursor < queued; cursor++) {
+            const position = queue[cursor];
+            for (let link = parentStarts[position]; link < parentStarts[position + 1]; link++) {
+                const ancestor = parentPositions[link];
+                if (reachedBy[ancestor] === source)
+                    continue;
+                reachedBy[ancestor] = source;
+                queue[queued++] = ancestor;
+                if (belowCounts[ancestor] === 0 || rank < worstRanks[ancestor])
+                    worstRanks[ancestor] = rank;
+                belowCounts[ancestor]++;
+            }
+        }
+    });
+    belowCounts.forEach((count, position) => {
+        if (count > 0)
+            (result[ids[position]] ??= {}).below = { count, worst: SEVERITY_ORDER[worstRanks[position]] };
+    });
+}
+export function decorations(view, root, kinds) {
+    const key = memoKey(view, kinds);
+    const cached = memo.get(root);
+    if (cached && cached.key === key)
+        return cached.result;
+    const result = {};
+    const vulnerable = [];
+    for (const node of root.packages.values()) {
+        const decoration = decorateNode(view, root, node);
+        if (decoration.vuln)
+            vulnerable.push({ node, severity: decoration.vuln.severity });
+        if (decoration.vuln || decoration.deprecated || decoration.outdated)
+            result[node.id] = decoration;
+    }
+    rollUpVulnerabilities(root, kinds, vulnerable, result);
+    memo.set(root, { key, result });
+    return result;
+}
+export function isDirectDependency(root, node, kinds) {
+    for (const dependentId of node.dependents) {
+        if (!dependentId.startsWith(IMPORTER_PREFIX))
+            continue;
+        const importer = findNode(root, dependentId);
+        if (importer?.deps.some((edge) => edge.to === node.id && kinds.has(edge.kind)))
+            return true;
+    }
+    return false;
+}
+export function issueCounts(view, root) {
+    const known = countsMemo.get(root);
+    if (known && known.revision === view.revision)
+        return known.counts;
+    const decorated = decorations(view, root, ALL_KINDS);
+    const severities = [];
+    let deprecated = 0;
+    let outdatedDirect = 0;
+    for (const node of root.packages.values()) {
+        const decoration = decorated[node.id];
+        if (!decoration)
+            continue;
+        if (decoration.vuln)
+            severities.push(decoration.vuln.severity);
+        if (decoration.deprecated)
+            deprecated++;
+        if (decoration.outdated && isDirectDependency(root, node, ALL_KINDS))
+            outdatedDirect++;
+    }
+    const counts = { vulnerable: severities.length, deprecated, outdatedDirect };
+    const worst = worstSeverity(severities);
+    if (worst)
+        counts.worst = worst;
+    countsMemo.set(root, { revision: view.revision, counts });
+    return counts;
+}